Trojan.Encoder.37711

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\c

Creates the following files on removable media

<Drive name for removable media>:\how to restore your mynvhefutrx files.txt
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\13.jpg
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Launches a large number of processes

Modifies file system

Creates the following files

%WINDIR%\temp\gss.bat
%ProgramFiles%\mozilla thunderbird\features\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\defaults\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\defaults\pref\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\defaults\messenger\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\chrome\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\visualelements\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\how to restore your mynvhefutrx files.txt
%ProgramFiles%\microsoft office\office16\onenote\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\uninstall\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\fonts\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\distibution\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\defaults\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\defaults\pref\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\browser\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\browser\features\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\browser\visualelements\how to restore your mynvhefutrx files.txt
%ProgramFiles%\microsoft office\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla firefox\gmp-clearkey\how to restore your mynvhefutrx files.txt
%ProgramFiles%\microsoft office\office16\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\fonts\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows media player\media renderer\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows security\browsercore\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows security\browsercore\en-us\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows photo viewer\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows photo viewer\en-us\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows multimedia platform\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows media player\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows media player\en-us\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows media player\visualizations\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows media player\skins\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\uninstall\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\isp\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows mail\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows defender.bak\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows defender.bak\en-us\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows defender.bak\offline\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows defender advanced threat protection\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows defender advanced threat protection\en-us\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows defender advanced threat protection\classification\how to restore your mynvhefutrx files.txt
%ProgramFiles%\winrar\how to restore your mynvhefutrx files.txt
%ProgramFiles%\mozilla thunderbird\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows media player\network sharing\how to restore your mynvhefutrx files.txt
%ProgramFiles%\microsoft office\office16\1033\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
D:\how to restore your mynvhefutrx files.txt
%WINDIR%\temp\dlzzxomorks.dll
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\applet\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\security\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\management\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\jfr\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\images\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\ext\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\amd64\how to restore your mynvhefutrx files.txt
C:\msocache\all users\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\server\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\plugin2\how to restore your mynvhefutrx files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\dtplugin\how to restore your mynvhefutrx files.txt
%ProgramFiles%\internet explorer\how to restore your mynvhefutrx files.txt
%ProgramFiles%\internet explorer\images\how to restore your mynvhefutrx files.txt
%ProgramFiles%\internet explorer\en-us\how to restore your mynvhefutrx files.txt
%ProgramFiles%\internet explorer\signup\how to restore your mynvhefutrx files.txt
C:\msocache\how to restore your mynvhefutrx files.txt
%ProgramFiles%\windows security\how to restore your mynvhefutrx files.txt
nul

Moves the following files

from %ProgramFiles%\internet explorer\signup\install.ins to %ProgramFiles%\internet explorer\signup\install.ins.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\onenote\prnms006.inf to %ProgramFiles%\microsoft office\office16\onenote\prnms006.inf.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\visiocustom.propdesc to %ProgramFiles%\microsoft office\office16\visiocustom.propdesc.mynvhefutrx
from %ProgramFiles%\mozilla firefox\accessible.tlb to %ProgramFiles%\mozilla firefox\accessible.tlb.mynvhefutrx
from %ProgramFiles%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi.mynvhefutrx
from %ProgramFiles%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi.mynvhefutrx
from %ProgramFiles%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi.mynvhefutrx
from %ProgramFiles%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi.mynvhefutrx
from %ProgramFiles%\mozilla firefox\install.log to %ProgramFiles%\mozilla firefox\install.log.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf.mynvhefutrx
from %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js to %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js.mynvhefutrx
from %ProgramFiles%\mozilla firefox\dependentlibs.list to %ProgramFiles%\mozilla firefox\dependentlibs.list.mynvhefutrx
from %ProgramFiles%\mozilla firefox\distibution\policies.json to %ProgramFiles%\mozilla firefox\distibution\policies.json.mynvhefutrx
from %ProgramFiles%\mozilla firefox\firefox.exe.sig to %ProgramFiles%\mozilla firefox\firefox.exe.sig.mynvhefutrx
from %ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf to %ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf.mynvhefutrx
from %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig to %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig.mynvhefutrx
from %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json to %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json.mynvhefutrx
from %ProgramFiles%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi.mynvhefutrx
from %ProgramFiles%\mozilla firefox\browser\omni.ja to %ProgramFiles%\mozilla firefox\browser\omni.ja.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties.mynvhefutrx
from %ProgramFiles%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\sound.properties to %ProgramFiles%\java\jre1.8.0_77\lib\sound.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs to %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy to %ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\java.security to %ProgramFiles%\java\jre1.8.0_77\lib\security\java.security.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy to %ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd to %ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_77\lib\tzmappings.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\release to %ProgramFiles%\java\jre1.8.0_77\release.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt to %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt to %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\custom.propdesc to %ProgramFiles%\microsoft office\office16\custom.propdesc.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\mso example setup file a.txt to %ProgramFiles%\microsoft office\office16\mso example setup file a.txt.mynvhefutrx
from %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd to %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\rt.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_77\lib\resources.jar.mynvhefutrx
from %ProgramFiles%\mozilla firefox\installation_telemetry.json to %ProgramFiles%\mozilla firefox\installation_telemetry.json.mynvhefutrx
from %ProgramFiles%\mozilla firefox\uninstall\uninstall.log to %ProgramFiles%\mozilla firefox\uninstall\uninstall.log.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\precomplete to %ProgramFiles%\mozilla thunderbird\precomplete.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\removed-files to %ProgramFiles%\mozilla thunderbird\removed-files.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf to %ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\uninstall\uninstall.log to %ProgramFiles%\mozilla thunderbird\uninstall\uninstall.log.mynvhefutrx
from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\default.sfx.mynvhefutrx
from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\isp\spamassassin.sfd to %ProgramFiles%\mozilla thunderbird\isp\spamassassin.sfd.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\isp\spampal.sfd to %ProgramFiles%\mozilla thunderbird\isp\spampal.sfd.mynvhefutrx
from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\descript.ion.mynvhefutrx
from %ProgramFiles%\winrar\zip64.sfx to %ProgramFiles%\winrar\zip64.sfx.mynvhefutrx
from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\license.txt.mynvhefutrx
from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\rar.txt.mynvhefutrx
from %ProgramFiles%\winrar\rarfiles.lst to %ProgramFiles%\winrar\rarfiles.lst.mynvhefutrx
from %ProgramFiles%\winrar\readme.txt to %ProgramFiles%\winrar\readme.txt.mynvhefutrx
from %ProgramFiles%\winrar\uninstall.lst to %ProgramFiles%\winrar\uninstall.lst.mynvhefutrx
from %ProgramFiles%\winrar\whatsnew.txt to %ProgramFiles%\winrar\whatsnew.txt.mynvhefutrx
from %ProgramFiles%\winrar\winrar.chm to %ProgramFiles%\winrar\winrar.chm.mynvhefutrx
from %ProgramFiles%\winrar\zip.sfx to %ProgramFiles%\winrar\zip.sfx.mynvhefutrx
from %ProgramFiles%\mozilla firefox\precomplete to %ProgramFiles%\mozilla firefox\precomplete.mynvhefutrx
from %ProgramFiles%\mozilla firefox\omni.ja to %ProgramFiles%\mozilla firefox\omni.ja.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\isp\bogofilter.sfd to %ProgramFiles%\mozilla thunderbird\isp\bogofilter.sfd.mynvhefutrx
from %ProgramFiles%\mozilla firefox\xul.dll.sig to %ProgramFiles%\mozilla firefox\xul.dll.sig.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\accessible.tlb to %ProgramFiles%\mozilla thunderbird\accessible.tlb.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\addressbookwindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\addressbookwindow.ico.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-alarm-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-alarm-dialog.ico.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-dialog.ico.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\isp\dspam.sfd to %ProgramFiles%\mozilla thunderbird\isp\dspam.sfd.mynvhefutrx
from %ProgramFiles%\mozilla firefox\removed-files to %ProgramFiles%\mozilla firefox\removed-files.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\isp\popfile.sfd to %ProgramFiles%\mozilla thunderbird\isp\popfile.sfd.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-summary-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-summary-dialog.ico.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\messengerwindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\messengerwindow.ico.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\msgcomposewindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\msgcomposewindow.ico.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js to %ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\dependentlibs.list to %ProgramFiles%\mozilla thunderbird\dependentlibs.list.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\features\wetransfer@extensions.thunderbird.net.xpi to %ProgramFiles%\mozilla thunderbird\features\wetransfer@extensions.thunderbird.net.xpi.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\install.log to %ProgramFiles%\mozilla thunderbird\install.log.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-dialog.ico.mynvhefutrx
from %ProgramFiles%\mozilla firefox\plugin-container.exe.sig to %ProgramFiles%\mozilla firefox\plugin-container.exe.sig.mynvhefutrx
from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-summary-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-summary-dialog.ico.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\net.properties to %ProgramFiles%\java\jre1.8.0_77\lib\net.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\meta-index to %ProgramFiles%\java\jre1.8.0_77\lib\meta-index.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\currency.data to %ProgramFiles%\java\jre1.8.0_77\lib\currency.data.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\license to %ProgramFiles%\java\jre1.8.0_77\license.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\readme.txt to %ProgramFiles%\java\jre1.8.0_77\readme.txt.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl to %ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\copyright to %ProgramFiles%\java\jre1.8.0_77\copyright.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\classlist to %ProgramFiles%\java\jre1.8.0_77\lib\classlist.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties to %ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar to %ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jce.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_77\lib\logging.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template to %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties to %ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template to %ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar to %ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf.mynvhefutrx
from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf.mynvhefutrx
from %ProgramFiles%\winrar\wincon.sfx to %ProgramFiles%\winrar\wincon.sfx.mynvhefutrx
from %ProgramFiles%\winrar\wincon64.sfx to %ProgramFiles%\winrar\wincon64.sfx.mynvhefutrx

Modifies the following files

D:\install.log.mynvhefutrx
<Drive name for removable media>:\samieee_obiee_presentation.pptx.mynvhefutrx
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.msi.mynvhefutrx
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.mynvhefutrx
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.mynvhefutrx
<Drive name for removable media>:\middaugh_keynote.pptx.mynvhefutrx
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.msi.mynvhefutrx
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.mynvhefutrx
<Drive name for removable media>:\hypothyroidism_slides.pptx.mynvhefutrx
<Drive name for removable media>:\gruenspecht_02172016.pptx.mynvhefutrx
<Drive name for removable media>:\roozenedowebinar.pptx.mynvhefutrx
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.mynvhefutrx
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.msi.mynvhefutrx
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.mynvhefutrx
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.mynvhefutrx
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.mynvhefutrx
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.cab.mynvhefutrx
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.msi.mynvhefutrx
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.mynvhefutrx
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.mynvhefutrx
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.mynvhefutrx
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.mynvhefutrx
<Drive name for removable media>:\10thingscondoms.pdf.mynvhefutrx
<Drive name for removable media>:\000814251_video_01.avi.mynvhefutrx
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.mynvhefutrx
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.msi.mynvhefutrx

Modifies multiple files.

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c "%WINDIR%\temp\gss.bat"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AsynchronousCausality/Causality"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/CaptureMonitor"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/GlitchDetection"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/Informational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/Performance"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/PlaybackManager"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audit/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Authentication User Interface/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AssignedAccess/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AxInstallService/Log"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BTH-BTHPORT/HCI"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BTH-BTHPORT/L2CAP"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BTH-BTHUSB/Performance"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AssignedAccessBroker/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AssignedAccessBroker/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AssignedAccess/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppxPackaging/Performance"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Backup"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppXDeploymentServer/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppXDeploymentServer/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppXDeploymentServer/Restricted"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ApplicabilityEngine/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ApplicabilityEngine/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppXDeployment/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Authentication/ProtectedUser-Client"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Inventory"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Telemetry"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Steps-Recorder"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppxPackaging/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppxPackaging/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-MSHTML/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/ApartmentUninitialize"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/Call"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/CreateInstance"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/ExtensionCatalog"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/FreeUnusedLibrary"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/RundownInstrumentation"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COMRuntime/Activations"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COMRuntime/MessageProcessing"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COMRuntime/Tracing"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CertPoleEng/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/ApartmentInitialize"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppSruProv"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CloudStore/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CloudStore/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CmiSetup/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CodeIntegrity/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CodeIntegrity/Verbose"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ComDlg32/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ComDlg32/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Compat-Appraiser/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppXDeployment/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CAPI2/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bluetooth-Bthmini/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Biometrics/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Biometrics/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker/BitLocker Management"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker/BitLocker Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker/Tracing"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bits-Client/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CDROM/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Battery/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bluetooth-Policy/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCache/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheMonitoring/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheSMB/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheSMB/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CAPI2/Catalog Database Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bits-Client/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppReadiness/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppReadiness/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppReadiness/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-GPIO2/Performance"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-I2C/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-I2C/Performance"
'<SYSTEM32>\wevtutil.exe' CL "Internet Explorer"
'<SYSTEM32>\wevtutil.exe' CL "Key Management Service"
'<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationDeviceMFT"
'<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationDeviceProxy"
'<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationFrameServer"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS-GPIO/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "AMSI/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-GPIO2/Debug"
'<SYSTEM32>\wevtutil.exe' CL "MedaFoundationVideoProc"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationDS"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationDeviceProxy"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationMP4"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationMediaEngine"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPerformance"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPerformanceCore"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPipeline"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPlatform"
'<SYSTEM32>\wevtutil.exe' CL "MedaFoundationVideoProcD3D"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationAsyncWrapper"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationContentProtection"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Compat-Appraiser/Operational"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationSrcPrefetch"
'<SYSTEM32>\wevtutil.exe' CL "General Logging"
'<SYSTEM32>\timeout.exe' /T 5
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=unbounded
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=401MB
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=unbounded
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=401MB
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=unbounded
'<SYSTEM32>\sc.exe' stop VSS
'<SYSTEM32>\cmd.exe' /c WEVTUTIL EL
'<SYSTEM32>\wevtutil.exe' CL "HardwareEvents"
'<SYSTEM32>\wevtutil.exe' CL "IHM_DebugChannel"
'<SYSTEM32>\wevtutil.exe' EL
'<SYSTEM32>\wevtutil.exe' CL "Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Application"
'<SYSTEM32>\wevtutil.exe' CL "DebugChannel"
'<SYSTEM32>\wevtutil.exe' CL "DirectShowFilterGraph"
'<SYSTEM32>\wevtutil.exe' CL "DirectShowPluginControl"
'<SYSTEM32>\wevtutil.exe' CL "Els_Hyphenation/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "EndpointMapper"
'<SYSTEM32>\wevtutil.exe' CL "FirstUXPerf-Analytic"
'<SYSTEM32>\wevtutil.exe' CL "ForwardedEvents"
'<SYSTEM32>\sc.exe' start vss
'<SYSTEM32>\wevtutil.exe' CL "AirSpaceChannel"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client-Streamingux/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ATAPort/General"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ATAPort/SATA-LPM"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ActionQueue/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-All-User-Install-Agent/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AllJoyn/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AllJoyn/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppHost/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppHost/ApplicationTracing"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppHost/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ASN1/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ADSI/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppLocker/MSI and Script"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppLocker/Packaged app-Deployment"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppLocker/Packaged app-Execution"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppModel-Runtime/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppModel-Runtime/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppModel-Runtime/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppModel-Runtime/Diagnostics"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppModel-State/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppModel-State/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppHost/Internal"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppLocker/EXE and DLL"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppID/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS-I2C/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Virtual Applications"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-SharedPerformance/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-IE/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-IEFRAME/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-JSDumpHeap/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-OneCore-Setup/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AAD/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AAD/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Admin/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Agent Driver/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Agent Driver/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-IPC/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-IEFRAME/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-RMS-MSIPC/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Containers-BindFlt/Debug"

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial