Trojan.Encoder.38891

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\sevenrecode

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

%WINDIR%\syswow64\<File name>.exe
%WINDIR%\media\windows feed discovered.wav.sos
%WINDIR%\media\windows hardware fail.wav.sos
%WINDIR%\media\windows hardware insert.wav.sos
%WINDIR%\media\windows hardware remove.wav.sos
%WINDIR%\media\windows information bar.wav.sos
%WINDIR%\media\windows logoff sound.wav.sos
%WINDIR%\media\windows logon sound.wav.sos
%WINDIR%\media\windows menu command.wav.sos
%WINDIR%\media\windows minimize.wav.sos
%WINDIR%\media\windows navigation start.wav.sos
%WINDIR%\media\windows notify.wav.sos
%WINDIR%\media\windows ding.wav.sos
%WINDIR%\media\windows pop-up blocked.wav.sos
%WINDIR%\media\windows exclamation.wav.sos
%WINDIR%\media\windows recycle.wav.sos
%WINDIR%\media\windows ringin.wav.sos
%WINDIR%\media\windows ringout.wav.sos
%WINDIR%\media\windows shutdown.wav.sos
%WINDIR%\media\windows startup.wav.sos
%WINDIR%\media\windows user account control.wav.sos
%WINDIR%\syswow64\ieuinit.inf.sos
%WINDIR%\syswow64\mapisvc.inf.sos
%WINDIR%\syswow64\slmgr.vbs.sos
%WINDIR%\syswow64\winrm.cmd.sos
%WINDIR%\syswow64\winrm.vbs.sos
%ProgramFiles%\java\jre1.8.0_45\readme.txt.sos
%WINDIR%\media\windows print complete.wav.sos
%ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.sos
%WINDIR%\media\windows restore.wav.sos
%WINDIR%\media\windows error.wav.sos
%WINDIR%\media\windows default.wav.sos
%WINDIR%\media\windows critical stop.wav.sos
%WINDIR%\inf\wsdscdrv.inf.sos
%WINDIR%\inf\wstorflt.inf.sos
%WINDIR%\inf\wstorvsc.inf.sos
%WINDIR%\inf\wudfusbcciddriver.inf.sos
%WINDIR%\inf\wvmbus.inf.sos
%WINDIR%\inf\wvmbushid.inf.sos
%WINDIR%\inf\wvmbusvideo.inf.sos
%WINDIR%\inf\wvmic.inf.sos
%WINDIR%\inf\xcbdav.inf.sos
%WINDIR%\inf\xnacc.inf.sos
%WINDIR%\media\chimes.wav.sos
%WINDIR%\media\chord.wav.sos
%WINDIR%\inf\ws3cap.inf.sos
%WINDIR%\media\ding.wav.sos
%WINDIR%\media\ir_end.wav.sos
%WINDIR%\media\ir_inter.wav.sos
%WINDIR%\media\notify.wav.sos
%WINDIR%\media\recycle.wav.sos
%WINDIR%\media\ringout.wav.sos
%WINDIR%\media\speech disambiguation.wav.sos
%WINDIR%\media\speech misrecognition.wav.sos
%WINDIR%\media\speech off.wav.sos
%WINDIR%\media\speech on.wav.sos
%WINDIR%\media\speech sleep.wav.sos
%WINDIR%\media\tada.wav.sos
%WINDIR%\media\windows balloon.wav.sos
%WINDIR%\media\windows battery critical.wav.sos
%WINDIR%\media\ir_begin.wav.sos
%WINDIR%\media\windows battery low.wav.sos
%WINDIR%\media\afternoon\windows hardware remove.wav.sos
%WINDIR%\inf\wsdprint.inf.sos
%WINDIR%\inf\wpdmtphw.inf.sos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicesimplifiedquanpin.txt.sos
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextserviceamharic.txt.sos
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicearray.txt.sos
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicedayi.txt.sos
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicesimplifiedquanpin.txt.sos
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicesimplifiedshuangpin.txt.sos
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicesimplifiedzhengma.txt.sos
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextserviceyi.txt.sos
C:\users\public\desktop\acrobat reader dc.lnk.sos
C:\users\public\desktop\firefox.lnk.sos
C:\users\public\desktop\mozilla thunderbird.lnk.sos
C:\users\public\desktop\opera.lnk.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt.sos
C:\users\public\desktop\steam.lnk.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt.sos
%WINDIR%\ehome\en-us\playready_eula.txt.sos
%WINDIR%\media\afternoon\windows balloon.wav.sos
%WINDIR%\media\afternoon\windows battery critical.wav.sos
%WINDIR%\media\afternoon\windows battery low.wav.sos
%WINDIR%\media\afternoon\windows critical stop.wav.sos
%WINDIR%\media\afternoon\windows default.wav.sos
%WINDIR%\media\afternoon\windows ding.wav.sos
%WINDIR%\media\afternoon\windows error.wav.sos
%WINDIR%\media\afternoon\windows exclamation.wav.sos
%WINDIR%\media\afternoon\windows feed discovered.wav.sos
%WINDIR%\media\afternoon\windows hardware fail.wav.sos
%WINDIR%\media\afternoon\windows hardware insert.wav.sos
%WINDIR%\ehome\en-us\epgtos.txt.sos
%ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.sos
%WINDIR%\ehome\en-us\playready_eula_oem.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt.sos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicesimplifiedshuangpin.txt.sos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicesimplifiedzhengma.txt.sos
%ProgramFiles%\windows nt\tabletextservice\tabletextserviceyi.txt.sos
%ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt.sos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicedayi.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt.sos
%ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt.sos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicearray.txt.sos
%WINDIR%\inf\prnlx007.inf.sos
%ProgramFiles%\windows nt\tabletextservice\tabletextserviceamharic.txt.sos
%WINDIR%\inf\tape.inf.sos
%WINDIR%\inf\prnxx002.inf.sos
%WINDIR%\inf\puwk.inf.sos
%WINDIR%\inf\qd3x64.inf.sos
%WINDIR%\inf\ql2300.inf.sos
%WINDIR%\inf\ql40xx.inf.sos
%WINDIR%\inf\ql40xx2.inf.sos
%WINDIR%\inf\ramdisk.inf.sos
%WINDIR%\inf\rawsilo.inf.sos
%WINDIR%\inf\rdlsbuscbs.inf.sos
%WINDIR%\inf\rdpbus.inf.sos
%WINDIR%\inf\rdvgwddm.inf.sos
%WINDIR%\inf\prnsv004.inf.sos
%WINDIR%\inf\ricoh.inf.sos
%WINDIR%\inf\prnts003.inf.sos
%WINDIR%\inf\rspndr.inf.sos
%WINDIR%\inf\sceregvl.inf.sos
%WINDIR%\inf\scrawpdo.inf.sos
%WINDIR%\inf\scsidev.inf.sos
%WINDIR%\inf\sdbus.inf.sos
%WINDIR%\inf\secrecs.inf.sos
%WINDIR%\inf\sensorsalsdriver.inf.sos
%WINDIR%\inf\sffdisk.inf.sos
%WINDIR%\inf\sisraid2.inf.sos
%WINDIR%\inf\sisraid4.inf.sos
%WINDIR%\inf\smartcrd.inf.sos
%WINDIR%\inf\stexstor.inf.sos
%WINDIR%\inf\rndiscmp.inf.sos
%WINDIR%\inf\sti.inf.sos
%WINDIR%\inf\sbp2.inf.sos
%WINDIR%\inf\prnts002.inf.sos
%WINDIR%\inf\prnsv003.inf.sos
%WINDIR%\inf\prnsv002.inf.sos
%WINDIR%\inf\prnlx00a.inf.sos
%WINDIR%\inf\prnlx00b.inf.sos
%WINDIR%\inf\prnlx00c.inf.sos
%WINDIR%\inf\prnlx00d.inf.sos
%WINDIR%\inf\prnlx00e.inf.sos
%WINDIR%\inf\prnlx00v.inf.sos
%WINDIR%\inf\prnlx00w.inf.sos
%WINDIR%\inf\prnlx00x.inf.sos
%WINDIR%\inf\prnlx00y.inf.sos
%WINDIR%\inf\prnlx00z.inf.sos
%WINDIR%\inf\prnms002.inf.sos
%WINDIR%\inf\prnnr002.inf.sos
%WINDIR%\inf\prnlx008.inf.sos
%WINDIR%\inf\prnnr003.inf.sos
%WINDIR%\inf\prnod002.inf.sos
%WINDIR%\inf\prnok002.inf.sos
%WINDIR%\inf\prnrc002.inf.sos
%WINDIR%\inf\prnrc003.inf.sos
%WINDIR%\inf\prnrc004.inf.sos
%WINDIR%\inf\prnrc005.inf.sos
%WINDIR%\inf\prnrc006.inf.sos
%WINDIR%\inf\prnrc007.inf.sos
%WINDIR%\inf\prnrc00a.inf.sos
%WINDIR%\inf\prnrc00b.inf.sos
%WINDIR%\inf\prnrc00c.inf.sos
%WINDIR%\inf\prnsa002.inf.sos
%WINDIR%\inf\prnsh002.inf.sos
%WINDIR%\inf\prnnr004.inf.sos
%WINDIR%\inf\prnso002.inf.sos
%WINDIR%\inf\wpdcomp.inf.sos
%WINDIR%\inf\wpdmtp.inf.sos
%WINDIR%\inf\wpdfs.inf.sos
%WINDIR%\inf\termmou.inf.sos
%WINDIR%\inf\wiabr007.inf.sos
%WINDIR%\inf\wiabr008.inf.sos
%WINDIR%\inf\wiabr009.inf.sos
%WINDIR%\inf\wiabr00a.inf.sos
%WINDIR%\inf\wiaca00a.inf.sos
%WINDIR%\inf\wiaca00b.inf.sos
%WINDIR%\inf\wiaca00c.inf.sos
%WINDIR%\inf\wiaca00d.inf.sos
%WINDIR%\inf\wiaca00e.inf.sos
%WINDIR%\inf\wiaca00f.inf.sos
%WINDIR%\inf\wiaca00i.inf.sos
%WINDIR%\inf\wiabr004.inf.sos
%WINDIR%\inf\wiacn001.inf.sos
%WINDIR%\inf\wiabr006.inf.sos
%WINDIR%\inf\wiaep003.inf.sos
%WINDIR%\inf\wiaky002.inf.sos
%WINDIR%\inf\wialx002.inf.sos
%WINDIR%\inf\wialx003.inf.sos
%WINDIR%\inf\wialx004.inf.sos
%WINDIR%\inf\wialx005.inf.sos
%WINDIR%\inf\wialx006.inf.sos
%WINDIR%\inf\wiasa002.inf.sos
%WINDIR%\inf\wiaxx002.inf.sos
%WINDIR%\inf\windowssideshowenhanceddriver.inf.sos
%WINDIR%\inf\winusb.inf.sos
%WINDIR%\inf\wnetvsc.inf.sos
%WINDIR%\inf\wiaep002.inf.sos
%WINDIR%\inf\synth3dvsc.inf.sos
%WINDIR%\inf\wiahp001.inf.sos
%WINDIR%\inf\wiabr005.inf.sos
%WINDIR%\inf\wiabr002.inf.sos
%WINDIR%\inf\wfplwf.inf.sos
%WINDIR%\inf\tpm.inf.sos
%WINDIR%\inf\transfercable.inf.sos
%WINDIR%\inf\tsgenericusbdriver.inf.sos
%WINDIR%\inf\tsprint.inf.sos
%WINDIR%\inf\tsusbhub.inf.sos
%WINDIR%\inf\tsusbhubfilter.inf.sos
%WINDIR%\inf\ts_generic.inf.sos
%WINDIR%\inf\ts_wpdmtp.inf.sos
%WINDIR%\inf\umbus.inf.sos
%WINDIR%\inf\umpass.inf.sos
%WINDIR%\inf\unknown.inf.sos
%WINDIR%\inf\usb.inf.sos
%WINDIR%\inf\termkbd.inf.sos
%WINDIR%\inf\usbcir.inf.sos
%WINDIR%\inf\usbprint.inf.sos
%WINDIR%\inf\usbstor.inf.sos
%WINDIR%\inf\usbvideo.inf.sos
%WINDIR%\inf\vhdmp.inf.sos
%WINDIR%\inf\volsnap.inf.sos
%WINDIR%\inf\volume.inf.sos
%WINDIR%\inf\vsmraid.inf.sos
%WINDIR%\inf\v_mscdsc.inf.sos
%WINDIR%\inf\wave.inf.sos
%WINDIR%\inf\wceisvista.inf.sos
%WINDIR%\inf\wd.inf.sos
%WINDIR%\inf\wdmaudio.inf.sos
%WINDIR%\inf\wdma_usb.inf.sos
%WINDIR%\inf\usbport.inf.sos
%WINDIR%\inf\wdmvsc.inf.sos
%WINDIR%\inf\tdibth.inf.sos
%WINDIR%\inf\prnlx009.inf.sos
%WINDIR%\media\afternoon\windows information bar.wav.sos
%WINDIR%\media\afternoon\windows pop-up blocked.wav.sos
%WINDIR%\media\quirky\windows balloon.wav.sos
%WINDIR%\media\quirky\windows battery critical.wav.sos
%WINDIR%\media\quirky\windows battery low.wav.sos
%WINDIR%\media\quirky\windows critical stop.wav.sos
%WINDIR%\media\quirky\windows default.wav.sos
%WINDIR%\media\quirky\windows ding.wav.sos
%WINDIR%\media\quirky\windows error.wav.sos
%WINDIR%\media\quirky\windows exclamation.wav.sos
%WINDIR%\media\quirky\windows feed discovered.wav.sos
%WINDIR%\media\quirky\windows hardware fail.wav.sos
%WINDIR%\media\quirky\windows hardware insert.wav.sos
%WINDIR%\media\landscape\windows pop-up blocked.wav.sos
%WINDIR%\media\quirky\windows hardware remove.wav.sos
%WINDIR%\media\landscape\windows user account control.wav.sos
%WINDIR%\media\quirky\windows logoff sound.wav.sos
%WINDIR%\media\quirky\windows navigation start.wav.sos
%WINDIR%\media\quirky\windows notify.wav.sos
%WINDIR%\media\quirky\windows pop-up blocked.wav.sos
%WINDIR%\media\quirky\windows print complete.wav.sos
%WINDIR%\media\quirky\windows user account control.wav.sos
%WINDIR%\media\raga\windows balloon.wav.sos
%WINDIR%\media\raga\windows battery critical.wav.sos
%WINDIR%\media\raga\windows battery low.wav.sos
%WINDIR%\media\raga\windows critical stop.wav.sos
%WINDIR%\media\raga\windows default.wav.sos
%WINDIR%\media\raga\windows ding.wav.sos
%WINDIR%\media\quirky\windows information bar.wav.sos
%WINDIR%\media\raga\windows error.wav.sos
%WINDIR%\media\quirky\windows logon sound.wav.sos
%WINDIR%\media\landscape\windows print complete.wav.sos
%WINDIR%\media\landscape\windows notify.wav.sos
%WINDIR%\media\landscape\windows navigation start.wav.sos
%WINDIR%\media\heritage\windows exclamation.wav.sos
%WINDIR%\media\heritage\windows feed discovered.wav.sos
%WINDIR%\media\heritage\windows hardware fail.wav.sos
%WINDIR%\media\heritage\windows hardware insert.wav.sos
%WINDIR%\media\heritage\windows hardware remove.wav.sos
%WINDIR%\media\heritage\windows information bar.wav.sos
%WINDIR%\media\heritage\windows logoff sound.wav.sos
%WINDIR%\media\heritage\windows logon sound.wav.sos
%WINDIR%\media\heritage\windows navigation start.wav.sos
%WINDIR%\media\heritage\windows notify.wav.sos
%WINDIR%\media\heritage\windows pop-up blocked.wav.sos
%WINDIR%\media\heritage\windows print complete.wav.sos
%WINDIR%\media\heritage\windows ding.wav.sos
%WINDIR%\media\heritage\windows user account control.wav.sos
%WINDIR%\media\landscape\windows battery critical.wav.sos
%WINDIR%\media\landscape\windows battery low.wav.sos
%WINDIR%\media\landscape\windows critical stop.wav.sos
%WINDIR%\media\landscape\windows default.wav.sos
%WINDIR%\media\landscape\windows ding.wav.sos
%WINDIR%\media\landscape\windows error.wav.sos
%WINDIR%\media\landscape\windows exclamation.wav.sos
%WINDIR%\media\landscape\windows feed discovered.wav.sos
%WINDIR%\media\landscape\windows hardware fail.wav.sos
%WINDIR%\media\landscape\windows hardware insert.wav.sos
%WINDIR%\media\landscape\windows hardware remove.wav.sos
%WINDIR%\media\landscape\windows information bar.wav.sos
%WINDIR%\media\landscape\windows logoff sound.wav.sos
%WINDIR%\media\landscape\windows balloon.wav.sos
%WINDIR%\media\landscape\windows logon sound.wav.sos
%WINDIR%\media\heritage\windows default.wav.sos
%WINDIR%\media\heritage\windows error.wav.sos
%WINDIR%\media\raga\windows exclamation.wav.sos
%WINDIR%\media\raga\windows hardware remove.wav.sos
%WINDIR%\media\sonata\windows default.wav.sos
%WINDIR%\media\sonata\windows ding.wav.sos
%WINDIR%\media\sonata\windows error.wav.sos
%WINDIR%\media\sonata\windows exclamation.wav.sos
%WINDIR%\media\sonata\windows feed discovered.wav.sos
%WINDIR%\media\sonata\windows hardware fail.wav.sos
%WINDIR%\media\sonata\windows hardware insert.wav.sos
%WINDIR%\media\sonata\windows hardware remove.wav.sos
%WINDIR%\media\sonata\windows information bar.wav.sos
%WINDIR%\media\sonata\windows logoff sound.wav.sos
%WINDIR%\media\sonata\windows logon sound.wav.sos
%WINDIR%\media\sonata\windows navigation start.wav.sos
%WINDIR%\media\sonata\windows battery low.wav.sos
%WINDIR%\media\sonata\windows critical stop.wav.sos
%WINDIR%\media\sonata\windows notify.wav.sos
%WINDIR%\media\sonata\windows user account control.wav.sos
%WINDIR%\performance\winsat\clip_1080_5sec_mpeg2_hd_15mbps.mpg.sos
%WINDIR%\performance\winsat\clip_480i_5sec_6mbps_new.mpg.sos
%WINDIR%\performance\winsat\clip_480p_5sec_6mbps_new.mpg.sos
<SYSTEM32>\catroot2\dberr.txt.sos
%WINDIR%\syswow64\drivers\gmreadme.txt.sos
%WINDIR%\syswow64\en-us\erofflps.txt.sos
%WINDIR%\syswow64\migwiz\sfpat.inf.sos
%WINDIR%\syswow64\migwiz\sfpatlh.inf.sos
%WINDIR%\syswow64\migwiz\sfpatw7.inf.sos
%WINDIR%\syswow64\migwiz\sfpatxp.inf.sos
%WINDIR%\syswow64\ras\pad.inf.sos
%WINDIR%\media\sonata\windows pop-up blocked.wav.sos
%WINDIR%\media\sonata\windows print complete.wav.sos
%WINDIR%\media\sonata\windows battery critical.wav.sos
%WINDIR%\media\savanna\windows user account control.wav.sos
%WINDIR%\inf\modemcsa.inf.sos
%WINDIR%\media\raga\windows information bar.wav.sos
%WINDIR%\media\raga\windows logoff sound.wav.sos
%WINDIR%\media\raga\windows logon sound.wav.sos
%WINDIR%\media\raga\windows navigation start.wav.sos
%WINDIR%\media\raga\windows notify.wav.sos
%WINDIR%\media\raga\windows pop-up blocked.wav.sos
%WINDIR%\media\raga\windows print complete.wav.sos
%WINDIR%\media\raga\windows user account control.wav.sos
%WINDIR%\media\savanna\windows balloon.wav.sos
%WINDIR%\media\savanna\windows battery critical.wav.sos
%WINDIR%\media\savanna\windows battery low.wav.sos
%WINDIR%\media\savanna\windows critical stop.wav.sos
%WINDIR%\media\savanna\windows default.wav.sos
%WINDIR%\media\savanna\windows ding.wav.sos
%WINDIR%\media\savanna\windows error.wav.sos
%WINDIR%\media\savanna\windows exclamation.wav.sos
%WINDIR%\media\savanna\windows feed discovered.wav.sos
%WINDIR%\media\savanna\windows hardware fail.wav.sos
%WINDIR%\media\savanna\windows hardware insert.wav.sos
%WINDIR%\media\savanna\windows hardware remove.wav.sos
%WINDIR%\media\savanna\windows information bar.wav.sos
%WINDIR%\media\savanna\windows logoff sound.wav.sos
%WINDIR%\media\savanna\windows logon sound.wav.sos
%WINDIR%\media\savanna\windows navigation start.wav.sos
%WINDIR%\media\savanna\windows notify.wav.sos
%WINDIR%\media\savanna\windows pop-up blocked.wav.sos
%WINDIR%\media\savanna\windows print complete.wav.sos
%WINDIR%\media\raga\windows feed discovered.wav.sos
%WINDIR%\media\raga\windows hardware insert.wav.sos
%WINDIR%\media\raga\windows hardware fail.wav.sos
%WINDIR%\media\afternoon\windows logon sound.wav.sos
%WINDIR%\media\afternoon\windows logoff sound.wav.sos
%WINDIR%\media\heritage\windows battery critical.wav.sos
%WINDIR%\media\characters\windows hardware remove.wav.sos
%WINDIR%\media\characters\windows information bar.wav.sos
%WINDIR%\media\characters\windows logoff sound.wav.sos
%WINDIR%\media\characters\windows logon sound.wav.sos
%WINDIR%\media\characters\windows navigation start.wav.sos
%WINDIR%\media\characters\windows notify.wav.sos
%WINDIR%\media\characters\windows pop-up blocked.wav.sos
%WINDIR%\media\characters\windows print complete.wav.sos
%WINDIR%\media\characters\windows user account control.wav.sos
%WINDIR%\media\cityscape\windows balloon.wav.sos
%WINDIR%\media\characters\windows exclamation.wav.sos
%WINDIR%\media\cityscape\windows battery critical.wav.sos
%WINDIR%\media\cityscape\windows critical stop.wav.sos
%WINDIR%\media\characters\windows hardware insert.wav.sos
%WINDIR%\media\cityscape\windows default.wav.sos
%WINDIR%\media\cityscape\windows error.wav.sos
%WINDIR%\media\cityscape\windows exclamation.wav.sos
%WINDIR%\media\cityscape\windows feed discovered.wav.sos
%WINDIR%\media\cityscape\windows hardware fail.wav.sos
%WINDIR%\media\cityscape\windows hardware insert.wav.sos
%WINDIR%\media\cityscape\windows hardware remove.wav.sos
%WINDIR%\media\cityscape\windows information bar.wav.sos
%WINDIR%\media\cityscape\windows logoff sound.wav.sos
%WINDIR%\media\cityscape\windows logon sound.wav.sos
%WINDIR%\media\cityscape\windows navigation start.wav.sos
%WINDIR%\media\cityscape\windows battery low.wav.sos
%WINDIR%\media\characters\windows error.wav.sos
%WINDIR%\media\heritage\windows battery low.wav.sos
%WINDIR%\media\cityscape\windows ding.wav.sos
%WINDIR%\media\characters\windows hardware fail.wav.sos
%WINDIR%\media\characters\windows ding.wav.sos
%WINDIR%\media\characters\windows default.wav.sos
%WINDIR%\media\afternoon\windows print complete.wav.sos
%WINDIR%\media\afternoon\windows user account control.wav.sos
%WINDIR%\media\calligraphy\windows balloon.wav.sos
%WINDIR%\media\calligraphy\windows battery critical.wav.sos
%WINDIR%\media\calligraphy\windows battery low.wav.sos
%WINDIR%\media\calligraphy\windows critical stop.wav.sos
%WINDIR%\media\calligraphy\windows default.wav.sos
%WINDIR%\media\calligraphy\windows ding.wav.sos
%WINDIR%\media\calligraphy\windows error.wav.sos
%WINDIR%\media\calligraphy\windows exclamation.wav.sos
%WINDIR%\media\calligraphy\windows feed discovered.wav.sos
%WINDIR%\media\calligraphy\windows hardware fail.wav.sos
%WINDIR%\media\afternoon\windows notify.wav.sos
%WINDIR%\media\calligraphy\windows hardware insert.wav.sos
%WINDIR%\media\calligraphy\windows information bar.wav.sos
%WINDIR%\media\calligraphy\windows logoff sound.wav.sos
%WINDIR%\media\calligraphy\windows logon sound.wav.sos
%WINDIR%\media\calligraphy\windows navigation start.wav.sos
%WINDIR%\media\calligraphy\windows notify.wav.sos
%WINDIR%\media\calligraphy\windows pop-up blocked.wav.sos
%WINDIR%\media\calligraphy\windows print complete.wav.sos
%WINDIR%\media\calligraphy\windows user account control.wav.sos
%WINDIR%\media\characters\windows balloon.wav.sos
%WINDIR%\media\characters\windows battery critical.wav.sos
%WINDIR%\media\characters\windows battery low.wav.sos
%WINDIR%\media\characters\windows critical stop.wav.sos
%WINDIR%\media\cityscape\windows notify.wav.sos
%WINDIR%\media\calligraphy\windows hardware remove.wav.sos
%WINDIR%\media\afternoon\windows navigation start.wav.sos
%WINDIR%\media\characters\windows feed discovered.wav.sos
%WINDIR%\media\heritage\windows critical stop.wav.sos
%WINDIR%\media\cityscape\windows pop-up blocked.wav.sos
%WINDIR%\media\delta\windows battery low.wav.sos
%WINDIR%\media\festival\windows notify.wav.sos
%WINDIR%\media\festival\windows pop-up blocked.wav.sos
%WINDIR%\media\festival\windows print complete.wav.sos
%WINDIR%\media\festival\windows user account control.wav.sos
%WINDIR%\media\garden\windows balloon.wav.sos
%WINDIR%\media\garden\windows battery critical.wav.sos
%WINDIR%\media\garden\windows battery low.wav.sos
%WINDIR%\media\garden\windows critical stop.wav.sos
%WINDIR%\media\garden\windows default.wav.sos
%WINDIR%\media\garden\windows ding.wav.sos
%WINDIR%\media\festival\windows information bar.wav.sos
%WINDIR%\media\garden\windows error.wav.sos
%WINDIR%\media\garden\windows feed discovered.wav.sos
%WINDIR%\media\festival\windows navigation start.wav.sos
%WINDIR%\media\garden\windows hardware fail.wav.sos
%WINDIR%\media\garden\windows hardware remove.wav.sos
%WINDIR%\media\garden\windows information bar.wav.sos
%WINDIR%\media\garden\windows logoff sound.wav.sos
%WINDIR%\media\garden\windows logon sound.wav.sos
%WINDIR%\media\garden\windows navigation start.wav.sos
%WINDIR%\media\garden\windows notify.wav.sos
%WINDIR%\media\garden\windows pop-up blocked.wav.sos
%WINDIR%\media\garden\windows print complete.wav.sos
%WINDIR%\media\garden\windows user account control.wav.sos
%WINDIR%\media\heritage\windows balloon.wav.sos
%WINDIR%\media\garden\windows exclamation.wav.sos
%WINDIR%\media\festival\windows hardware remove.wav.sos
%WINDIR%\media\cityscape\windows user account control.wav.sos
%WINDIR%\media\garden\windows hardware insert.wav.sos
%WINDIR%\media\festival\windows logon sound.wav.sos
%WINDIR%\media\festival\windows hardware insert.wav.sos
%WINDIR%\media\festival\windows hardware fail.wav.sos
%WINDIR%\media\delta\windows critical stop.wav.sos
%WINDIR%\media\delta\windows default.wav.sos
%WINDIR%\media\delta\windows ding.wav.sos
%WINDIR%\media\delta\windows error.wav.sos
%WINDIR%\media\delta\windows exclamation.wav.sos
%WINDIR%\media\delta\windows feed discovered.wav.sos
%WINDIR%\media\delta\windows hardware fail.wav.sos
%WINDIR%\media\delta\windows hardware insert.wav.sos
%WINDIR%\media\delta\windows hardware remove.wav.sos
%WINDIR%\media\delta\windows information bar.wav.sos
%WINDIR%\media\delta\windows logoff sound.wav.sos
%WINDIR%\media\delta\windows logon sound.wav.sos
%WINDIR%\media\delta\windows battery critical.wav.sos
%WINDIR%\media\delta\windows navigation start.wav.sos
%WINDIR%\media\delta\windows pop-up blocked.wav.sos
%WINDIR%\media\delta\windows print complete.wav.sos
%WINDIR%\media\delta\windows user account control.wav.sos
%WINDIR%\media\festival\windows balloon.wav.sos
%WINDIR%\media\festival\windows battery critical.wav.sos
%WINDIR%\media\festival\windows battery low.wav.sos
%WINDIR%\media\festival\windows critical stop.wav.sos
%WINDIR%\media\festival\windows default.wav.sos
%WINDIR%\media\festival\windows ding.wav.sos
%WINDIR%\media\festival\windows error.wav.sos
%WINDIR%\media\festival\windows exclamation.wav.sos
%WINDIR%\media\festival\windows feed discovered.wav.sos
%WINDIR%\media\cityscape\windows print complete.wav.sos
%WINDIR%\media\delta\windows notify.wav.sos
%WINDIR%\media\delta\windows balloon.wav.sos
%WINDIR%\media\festival\windows logoff sound.wav.sos
%WINDIR%\inf\prnlx006.inf.sos
%WINDIR%\inf\prnlx005.inf.sos
%WINDIR%\inf\prnlx004.inf.sos
%WINDIR%\inf\hidserv.inf.sos
%WINDIR%\inf\hpoa1nd.inf.sos
%WINDIR%\inf\hpoa1sd.inf.sos
%WINDIR%\inf\hpoa1so.inf.sos
%WINDIR%\inf\hpoa1ss.inf.sos
%WINDIR%\inf\hpsamd.inf.sos
%WINDIR%\inf\iastorv.inf.sos
%WINDIR%\inf\igdlh.inf.sos
%WINDIR%\inf\iirsp.inf.sos
%WINDIR%\inf\iirsp2.inf.sos
%WINDIR%\inf\image.inf.sos
%WINDIR%\inf\hiddigi.inf.sos
%WINDIR%\inf\input.inf.sos
%WINDIR%\inf\hidirkbd.inf.sos
%WINDIR%\inf\iscsi.inf.sos
%WINDIR%\inf\ks.inf.sos
%WINDIR%\inf\kscaptur.inf.sos
%WINDIR%\inf\ksfilter.inf.sos
%WINDIR%\inf\lltdio.inf.sos
%WINDIR%\inf\lsi_fc.inf.sos
%WINDIR%\inf\lsi_sas.inf.sos
%WINDIR%\inf\lsi_sas2.inf.sos
%WINDIR%\inf\lsi_scsi.inf.sos
%WINDIR%\inf\machine.inf.sos
%WINDIR%\inf\mchgr.inf.sos
%WINDIR%\inf\mcx2.inf.sos
%WINDIR%\inf\ipmidrv.inf.sos
%WINDIR%\inf\hidbth.inf.sos
%WINDIR%\inf\keyboard.inf.sos
%WINDIR%\inf\hdaudss.inf.sos
%WINDIR%\inf\hdaudio.inf.sos
%WINDIR%\inf\cxraptor_philipstuv1236d_ibv64.inf.sos
%WINDIR%\inf\defltbase.inf.sos
%WINDIR%\inf\defltwk.inf.sos
%WINDIR%\inf\digitalmediadevice.inf.sos
%WINDIR%\inf\disk.inf.sos
%WINDIR%\inf\display.inf.sos
%WINDIR%\inf\divacx64.inf.sos
%WINDIR%\inf\dot4.inf.sos
%WINDIR%\inf\dot4prt.inf.sos
%WINDIR%\inf\dshowext.inf.sos
%WINDIR%\inf\dwup.inf.sos
%WINDIR%\inf\eaphost.inf.sos
%WINDIR%\inf\ehstorcertdrv.inf.sos
%WINDIR%\inf\ehstorpwddrv.inf.sos
%WINDIR%\inf\dc21x4vm.inf.sos
%WINDIR%\inf\elxstor.inf.sos
%WINDIR%\inf\faxca003.inf.sos
%WINDIR%\inf\faxcn001.inf.sos
%WINDIR%\inf\faxcn002.inf.sos
%WINDIR%\inf\fdc.inf.sos
%WINDIR%\inf\flpydisk.inf.sos
%WINDIR%\inf\fontsetup.inf.sos
%WINDIR%\inf\gameport.inf.sos
%WINDIR%\inf\hal.inf.sos
%WINDIR%\inf\hcw72b64.inf.sos
%WINDIR%\inf\hcw85b64.inf.sos
%WINDIR%\inf\hcw85c64.inf.sos
%WINDIR%\inf\hdaudbus.inf.sos
%WINDIR%\inf\mdm3com.inf.sos
%WINDIR%\inf\errata.inf.sos
%WINDIR%\inf\cxraptor_fm1236mk5_ibv64.inf.sos
%WINDIR%\inf\mdmgl008.inf.sos
%WINDIR%\inf\cxraptor_fm1216mk5_ibv64.inf.sos
%WINDIR%\inf\mdmcpq2.inf.sos
%WINDIR%\inf\mdmcrtix.inf.sos
%WINDIR%\inf\mdmcxhv6.inf.sos
%WINDIR%\inf\mdmcxpv6.inf.sos
%WINDIR%\inf\mdmdcm5.inf.sos
%WINDIR%\inf\mdmdcm6.inf.sos
%WINDIR%\inf\mdmdf56f.inf.sos
%WINDIR%\inf\mdmdgitn.inf.sos
%WINDIR%\inf\mdmdp2.inf.sos
%WINDIR%\inf\mdmdsi.inf.sos
%WINDIR%\inf\mdmdyna.inf.sos
%WINDIR%\inf\mdmeiger.inf.sos
%WINDIR%\inf\mdmcpq.inf.sos
%WINDIR%\inf\mdmelsa.inf.sos
%WINDIR%\inf\mdmcpv.inf.sos
%WINDIR%\inf\mdmeric2.inf.sos
%WINDIR%\inf\mdmfj2.inf.sos
%WINDIR%\inf\mdmgatew.inf.sos
%WINDIR%\inf\mdmgcs.inf.sos
%WINDIR%\inf\mdmgen.inf.sos
%WINDIR%\inf\mdmgl001.inf.sos
%WINDIR%\inf\mdmgl002.inf.sos
%WINDIR%\inf\mdmgl003.inf.sos
%WINDIR%\inf\mdmgl004.inf.sos
%WINDIR%\inf\mdmgl005.inf.sos
%WINDIR%\inf\mdmgl006.inf.sos
%WINDIR%\inf\mdmgl007.inf.sos
%WINDIR%\inf\mdmeric.inf.sos
%WINDIR%\inf\mdmcomp.inf.sos
%WINDIR%\inf\mdmetech.inf.sos
%WINDIR%\inf\mdmcommu.inf.sos
%WINDIR%\inf\mdmcom1.inf.sos
%WINDIR%\inf\mdmags64.inf.sos
%WINDIR%\inf\mdmaiwa.inf.sos
%WINDIR%\inf\mdmaiwa3.inf.sos
%WINDIR%\inf\mdmaiwa4.inf.sos
%WINDIR%\inf\mdmaiwa5.inf.sos
%WINDIR%\inf\mdmaiwat.inf.sos
%WINDIR%\inf\mdmar1.inf.sos
%WINDIR%\inf\mdmarch.inf.sos
%WINDIR%\inf\mdmarn.inf.sos
%WINDIR%\inf\mdmati.inf.sos
%WINDIR%\inf\mdmatm2k.inf.sos
%WINDIR%\inf\mdmaus.inf.sos
%WINDIR%\inf\mdmboca.inf.sos
%WINDIR%\inf\mdmbr002.inf.sos
%WINDIR%\inf\mdmairte.inf.sos
%WINDIR%\inf\mdmbr004.inf.sos
%WINDIR%\inf\mdmbr006.inf.sos
%WINDIR%\inf\mdmbr007.inf.sos
%WINDIR%\inf\mdmbr008.inf.sos
%WINDIR%\inf\mdmbr00a.inf.sos
%WINDIR%\inf\mdmbsb.inf.sos
%WINDIR%\inf\mdmbtmdm.inf.sos
%WINDIR%\inf\mdmbug3.inf.sos
%WINDIR%\inf\mdmbw561.inf.sos
%WINDIR%\inf\mdmc26a.inf.sos
%WINDIR%\inf\mdmcdp.inf.sos
%WINDIR%\inf\mdmcm28.inf.sos
%WINDIR%\inf\mdmcodex.inf.sos
%WINDIR%\inf\mdmadc.inf.sos
%WINDIR%\inf\mdmbr005.inf.sos
%WINDIR%\inf\mdm5674a.inf.sos
%WINDIR%\inf\mdmagm64.inf.sos
%WINDIR%\inf\cxfalcon_ibv64.inf.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.sos
%APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.sos
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.sos
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.sos
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.sos
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.sos
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.sos
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.sos
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.sos
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.sos
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.sos
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.sos
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.sos
%APPDATA%\microsoft\windows\sendto\fax recipient.lnk.sos
C:\users\public\documents\<File name>.exe
%HOMEPATH%\desktop\api-hashmap.html.sos
%HOMEPATH%\desktop\archer.avi.sos
%HOMEPATH%\desktop\browse.html.sos
%HOMEPATH%\desktop\dashborder_120.bmp.sos
%HOMEPATH%\desktop\google chrome.lnk.sos
%HOMEPATH%\desktop\issi2013_template_for_posters.docx.sos
%HOMEPATH%\desktop\telegram.lnk.sos
%HOMEPATH%\links\desktop.lnk.sos
%HOMEPATH%\links\downloads.lnk.sos
%HOMEPATH%\links\recentplaces.lnk.sos
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.sos
%TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.sos
%TEMP%\dd_setuputility.txt.sos
%HOMEPATH%\desktop\alert.html.sos
%TEMP%\dd_vcredistmsi12db.txt.sos
%TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.sos
%TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.sos
%TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.sos
%TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.sos
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.sos
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.sos
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.sos
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.sos
%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.sos
%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.sos
%APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.sos
%APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.sos
%TEMP%\dd_vcredistui12db.txt.sos
%WINDIR%\inf\cxfalpal_ibv64.inf.sos
%WINDIR%\inf\mdmgl009.inf.sos
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.sos
%WINDIR%\inf\atiilhag.inf.sos
%WINDIR%\inf\avc.inf.sos
%WINDIR%\inf\averfx2hbh826d_noaverir_x64.inf.sos
%WINDIR%\inf\averfx2hbtv_x64.inf.sos
%WINDIR%\inf\averfx2swtv_noavin_x64.inf.sos
%WINDIR%\inf\averfx2swtv_x64.inf.sos
%WINDIR%\inf\averhbh826_noaverir_x64.inf.sos
%WINDIR%\inf\avmx64c.inf.sos
%WINDIR%\inf\battery.inf.sos
%WINDIR%\inf\bda.inf.sos
%WINDIR%\inf\blbdrive.inf.sos
%WINDIR%\inf\brmfcmdm.inf.sos
%WINDIR%\inf\arcsas.inf.sos
%WINDIR%\inf\brmfcmf.inf.sos
%WINDIR%\inf\atiriol6.inf.sos
%WINDIR%\inf\brmfcumd.inf.sos
%WINDIR%\inf\brmfport.inf.sos
%WINDIR%\inf\bth.inf.sos
%WINDIR%\inf\bthmtpenum.inf.sos
%WINDIR%\inf\bthpan.inf.sos
%WINDIR%\inf\bthprint.inf.sos
%WINDIR%\inf\bthspp.inf.sos
%WINDIR%\inf\cdrom.inf.sos
%WINDIR%\inf\circlass.inf.sos
%WINDIR%\inf\compositebus.inf.sos
%WINDIR%\inf\cpu.inf.sos
%WINDIR%\inf\crcdisk.inf.sos
%WINDIR%\inf\brmfcsto.inf.sos
%WINDIR%\inf\arc.inf.sos
%WINDIR%\inf\brmfcwia.inf.sos
%WINDIR%\inf\apps.inf.sos
%WINDIR%\inf\angelu64.inf.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.sos
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.sos
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.sos
C:\kms\kms_vl_all_aio.cmd.sos
%WINDIR%\ocsetup_cbs_uninstall_searchengine-client-package.txt.sos
%ProgramFiles%\winrar\license.txt.sos
%ProgramFiles%\winrar\rar.txt.sos
%ProgramFiles%\winrar\readme.txt.sos
%ProgramFiles%\winrar\whatsnew.txt.sos
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.sos
%WINDIR%\bitlockerdiscoveryvolumecontents\autorun.inf.sos
%WINDIR%\inf\61883.inf.sos
%WINDIR%\inf\acpi.inf.sos
%WINDIR%\inf\acpipmi.inf.sos
%WINDIR%\inf\adp94xx.inf.sos
%WINDIR%\inf\adpahci.inf.sos
%WINDIR%\inf\adpu320.inf.sos
%WINDIR%\inf\af9035bda.inf.sos
%WINDIR%\inf\agp.inf.sos
%WINDIR%\inf\amdsata.inf.sos
%WINDIR%\inf\amdsbs.inf.sos
%WINDIR%\inf\angel264.inf.sos
%WINDIR%\inf\angel64.inf.sos
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.sos
%WINDIR%\inf\1394.inf.sos
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.sos
%WINDIR%\inf\hidir.inf.sos
%WINDIR%\inf\mdmgl010.inf.sos
%WINDIR%\inf\netvwifibus.inf.sos
%WINDIR%\inf\netw5v64.inf.sos
%WINDIR%\inf\netxex64.inf.sos
%WINDIR%\inf\netxfx64.inf.sos
%WINDIR%\inf\nfrd960.inf.sos
%WINDIR%\inf\ntprint.inf.sos
%WINDIR%\inf\nulhpopr.inf.sos
%WINDIR%\inf\nvraid.inf.sos
%WINDIR%\inf\nv_lh.inf.sos
%WINDIR%\inf\oem0.inf.sos
%WINDIR%\inf\oem1.inf.sos
%WINDIR%\inf\netvg62a.inf.sos
%WINDIR%\inf\pcmcia.inf.sos
%WINDIR%\inf\ph3xibc1.inf.sos
%WINDIR%\inf\netvwifimp.inf.sos
%WINDIR%\inf\ph3xibc10.inf.sos
%WINDIR%\inf\ph3xibc12.inf.sos
%WINDIR%\inf\ph3xibc2.inf.sos
%WINDIR%\inf\ph3xibc3.inf.sos
%WINDIR%\inf\ph3xibc4.inf.sos
%WINDIR%\inf\ph3xibc5.inf.sos
%WINDIR%\inf\ph3xibc6.inf.sos
%WINDIR%\inf\ph3xibc7.inf.sos
%WINDIR%\inf\ph3xibc8.inf.sos
%WINDIR%\inf\ph3xibc9.inf.sos
%WINDIR%\inf\ph6xib64c0.inf.sos
%WINDIR%\inf\ph3xibc0.inf.sos
%WINDIR%\inf\netvfx64.inf.sos
%WINDIR%\inf\netg664.inf.sos
%WINDIR%\inf\ph3xibc11.inf.sos
%WINDIR%\inf\netvwififlt.inf.sos
%WINDIR%\inf\nettun.inf.sos
%WINDIR%\inf\nettcpip.inf.sos
%WINDIR%\inf\netk57a.inf.sos
%WINDIR%\inf\netl160a.inf.sos
%WINDIR%\inf\netl1c64.inf.sos
%WINDIR%\inf\netl1e64.inf.sos
%WINDIR%\inf\netl260a.inf.sos
%WINDIR%\inf\netloop.inf.sos
%WINDIR%\inf\netmscli.inf.sos
%WINDIR%\inf\netmyk00.inf.sos
%WINDIR%\inf\netnb.inf.sos
%WINDIR%\inf\netnvm64.inf.sos
%WINDIR%\inf\netnvma.inf.sos
%WINDIR%\inf\netnwifi.inf.sos
%WINDIR%\inf\netip6.inf.sos
%WINDIR%\inf\netpacer.inf.sos
%WINDIR%\inf\netr28ux.inf.sos
%WINDIR%\inf\netr28x.inf.sos
%WINDIR%\inf\netr7364.inf.sos
%WINDIR%\inf\netrasa.inf.sos
%WINDIR%\inf\netrass.inf.sos
%WINDIR%\inf\netrast.inf.sos
%WINDIR%\inf\netrndis.inf.sos
%WINDIR%\inf\netrtl64.inf.sos
%WINDIR%\inf\netrtx64.inf.sos
%WINDIR%\inf\netserv.inf.sos
%WINDIR%\inf\netsstpa.inf.sos
%WINDIR%\inf\netsstpt.inf.sos
%WINDIR%\inf\ph6xib64c1.inf.sos
%WINDIR%\inf\netpgm.inf.sos
%WINDIR%\inf\netimm.inf.sos
%WINDIR%\inf\netefe3e.inf.sos
%WINDIR%\inf\netirda.inf.sos
%WINDIR%\inf\printupg.inf.sos
%WINDIR%\inf\prnbr006.inf.sos
%WINDIR%\inf\prngt004.inf.sos
%WINDIR%\inf\prnhp002.inf.sos
%WINDIR%\inf\prnhp003.inf.sos
%WINDIR%\inf\prnhp004.inf.sos
%WINDIR%\inf\prnhp005.inf.sos
%WINDIR%\inf\prnin002.inf.sos
%WINDIR%\inf\prnin003.inf.sos
%WINDIR%\inf\prnin004.inf.sos
%WINDIR%\inf\prnkm002.inf.sos
%WINDIR%\inf\prnkm003.inf.sos
%WINDIR%\inf\prnfx002.inf.sos
%WINDIR%\inf\prnkm004.inf.sos
%WINDIR%\inf\prnky002.inf.sos
%WINDIR%\inf\prngt003.inf.sos
%WINDIR%\inf\prnky003.inf.sos
%WINDIR%\inf\prnky005.inf.sos
%WINDIR%\inf\prnky006.inf.sos
%WINDIR%\inf\prnky007.inf.sos
%WINDIR%\inf\prnky008.inf.sos
%WINDIR%\inf\prnky009.inf.sos
%WINDIR%\inf\prnle002.inf.sos
%WINDIR%\inf\prnle003.inf.sos
%WINDIR%\inf\prnle004.inf.sos
%WINDIR%\inf\prnlx002.inf.sos
%WINDIR%\inf\prnlx003.inf.sos
%WINDIR%\inf\prnkm005.inf.sos
%WINDIR%\inf\prnep00l.inf.sos
%WINDIR%\inf\prnbr003.inf.sos
%WINDIR%\inf\prnky004.inf.sos
%WINDIR%\inf\prngt002.inf.sos
%WINDIR%\inf\prnep00g.inf.sos
%WINDIR%\inf\prnep00f.inf.sos
%WINDIR%\inf\prnbr007.inf.sos
%WINDIR%\inf\prnbr008.inf.sos
%WINDIR%\inf\prnbr009.inf.sos
%WINDIR%\inf\prnbr00a.inf.sos
%WINDIR%\inf\prnca003.inf.sos
%WINDIR%\inf\prnca00a.inf.sos
%WINDIR%\inf\prnca00b.inf.sos
%WINDIR%\inf\prnca00c.inf.sos
%WINDIR%\inf\prnca00d.inf.sos
%WINDIR%\inf\prnca00e.inf.sos
%WINDIR%\inf\prnca00f.inf.sos
%WINDIR%\inf\prnca00g.inf.sos
%WINDIR%\inf\prnbr005.inf.sos
%WINDIR%\inf\prnca00h.inf.sos
%WINDIR%\inf\prnca00x.inf.sos
%WINDIR%\inf\prnca00y.inf.sos
%WINDIR%\inf\prnca00z.inf.sos
%WINDIR%\inf\prnep002.inf.sos
%WINDIR%\inf\prnep003.inf.sos
%WINDIR%\inf\prnep004.inf.sos
%WINDIR%\inf\prnep005.inf.sos
%WINDIR%\inf\prnep00a.inf.sos
%WINDIR%\inf\prnep00b.inf.sos
%WINDIR%\inf\prnep00c.inf.sos
%WINDIR%\inf\prnep00d.inf.sos
%WINDIR%\inf\prnep00e.inf.sos
%WINDIR%\inf\prnbr002.inf.sos
%WINDIR%\inf\prnca00i.inf.sos
%WINDIR%\inf\prnbr004.inf.sos
%WINDIR%\inf\prnge001.inf.sos
%WINDIR%\inf\netevbda.inf.sos
%WINDIR%\inf\nete1g3e.inf.sos
%WINDIR%\inf\mdmgsm.inf.sos
%WINDIR%\inf\mdmntt1.inf.sos
%WINDIR%\inf\mdmnttd2.inf.sos
%WINDIR%\inf\mdmnttd6.inf.sos
%WINDIR%\inf\mdmnttme.inf.sos
%WINDIR%\inf\mdmnttp.inf.sos
%WINDIR%\inf\mdmnttp2.inf.sos
%WINDIR%\inf\mdmnttte.inf.sos
%WINDIR%\inf\mdmolic.inf.sos
%WINDIR%\inf\mdmomrn3.inf.sos
%WINDIR%\inf\mdmoptn.inf.sos
%WINDIR%\inf\mdmosi.inf.sos
%WINDIR%\inf\mdmnis5t.inf.sos
%WINDIR%\inf\mdmpace.inf.sos
%WINDIR%\inf\mdmnova.inf.sos
%WINDIR%\inf\mdmpin.inf.sos
%WINDIR%\inf\mdmpp.inf.sos
%WINDIR%\inf\mdmpsion.inf.sos
%WINDIR%\inf\mdmracal.inf.sos
%WINDIR%\inf\mdmrock.inf.sos
%WINDIR%\inf\mdmrock3.inf.sos
%WINDIR%\inf\mdmrock4.inf.sos
%WINDIR%\inf\mdmrock5.inf.sos
%WINDIR%\inf\mdmsier.inf.sos
%WINDIR%\inf\mdmsii64.inf.sos
%WINDIR%\inf\mdmsmart.inf.sos
%WINDIR%\inf\mdmsonyu.inf.sos
%WINDIR%\inf\mdmpenr.inf.sos
%WINDIR%\inf\mdmnis3t.inf.sos
%WINDIR%\inf\mdmpn1.inf.sos
%WINDIR%\inf\mdmnis2u.inf.sos
%WINDIR%\inf\mdmnis1u.inf.sos
%WINDIR%\inf\mdmhaeu.inf.sos
%WINDIR%\inf\mdmhay2.inf.sos
%WINDIR%\inf\mdmhayes.inf.sos
%WINDIR%\inf\mdminfot.inf.sos
%WINDIR%\inf\mdmiodat.inf.sos
%WINDIR%\inf\mdmirmdm.inf.sos
%WINDIR%\inf\mdmisdn.inf.sos
%WINDIR%\inf\mdmjf56e.inf.sos
%WINDIR%\inf\mdmke.inf.sos
%WINDIR%\inf\mdmkortx.inf.sos
%WINDIR%\inf\mdmlasat.inf.sos
%WINDIR%\inf\mdmlasno.inf.sos
%WINDIR%\inf\mdmlucnt.inf.sos
%WINDIR%\inf\mdmmc288.inf.sos
%WINDIR%\inf\mdmhandy.inf.sos
%WINDIR%\inf\mdmmcd.inf.sos
%WINDIR%\inf\mdmmct.inf.sos
%WINDIR%\inf\mdmmega.inf.sos
%WINDIR%\inf\mdmmetri.inf.sos
%WINDIR%\inf\mdmmhrtz.inf.sos
%WINDIR%\inf\mdmmhzel.inf.sos
%WINDIR%\inf\mdmminij.inf.sos
%WINDIR%\inf\mdmmod.inf.sos
%WINDIR%\inf\mdmmot64.inf.sos
%WINDIR%\inf\mdmmoto1.inf.sos
%WINDIR%\inf\mdmmotou.inf.sos
%WINDIR%\inf\mdmmts.inf.sos
%WINDIR%\inf\mdmneuhs.inf.sos
%WINDIR%\inf\mdmsun1.inf.sos
%WINDIR%\inf\mdmmcom.inf.sos
%WINDIR%\inf\mdmsun2.inf.sos
%WINDIR%\inf\mdmnokia.inf.sos
%WINDIR%\inf\mdmsupr3.inf.sos
%WINDIR%\inf\msclmd.inf.sos
%WINDIR%\inf\msdsm.inf.sos
%WINDIR%\inf\msdv.inf.sos
%WINDIR%\inf\mshdc.inf.sos
%WINDIR%\inf\msmouse.inf.sos
%WINDIR%\inf\msports.inf.sos
%WINDIR%\inf\mstape.inf.sos
%WINDIR%\inf\mtconfig.inf.sos
%WINDIR%\inf\multiprt.inf.sos
%WINDIR%\inf\ndiscap.inf.sos
%WINDIR%\inf\ndisuio.inf.sos
%WINDIR%\inf\net1kx64.inf.sos
%WINDIR%\inf\net1qx64.inf.sos
%WINDIR%\inf\net1yx64.inf.sos
%WINDIR%\inf\net44amd.inf.sos
%WINDIR%\inf\net8185.inf.sos
%WINDIR%\inf\net8187bv64.inf.sos
%WINDIR%\inf\net8187se64.inf.sos
%WINDIR%\inf\netathrx.inf.sos
%WINDIR%\inf\netavpna.inf.sos
%WINDIR%\inf\netavpnt.inf.sos
%WINDIR%\inf\netb57va.inf.sos
%WINDIR%\inf\netbc664.inf.sos
%WINDIR%\inf\netbrdgm.inf.sos
%WINDIR%\inf\netbrdgs.inf.sos
%WINDIR%\inf\netbvbda.inf.sos
%WINDIR%\inf\netbxnda.inf.sos
%WINDIR%\inf\nete1e3e.inf.sos
%WINDIR%\inf\mpio.inf.sos
%WINDIR%\inf\mdmsupra.inf.sos
%WINDIR%\inf\msdri.inf.sos
%WINDIR%\media\sonata\windows balloon.wav.sos
%WINDIR%\syswow64\ras\switch.inf.sos
%WINDIR%\inf\mf.inf.sos
%WINDIR%\inf\mdmtdk.inf.sos
%WINDIR%\inf\mdmtdkj2.inf.sos
%WINDIR%\inf\mdmtdkj3.inf.sos
%WINDIR%\inf\mdmtdkj4.inf.sos
%WINDIR%\inf\mdmtdkj5.inf.sos
%WINDIR%\inf\mdmtdkj6.inf.sos
%WINDIR%\inf\mdmtdkj7.inf.sos
%WINDIR%\inf\mdmtexas.inf.sos
%WINDIR%\inf\mdmti.inf.sos
%WINDIR%\inf\mdmtkr.inf.sos
%WINDIR%\inf\mdmtron.inf.sos
%WINDIR%\inf\mdmusrf.inf.sos
%WINDIR%\inf\mdmusrg.inf.sos
%WINDIR%\inf\mdmsuprv.inf.sos
%WINDIR%\inf\mdmusrgl.inf.sos
%WINDIR%\inf\mdmusrsp.inf.sos
%WINDIR%\inf\mdmvdot.inf.sos
%WINDIR%\inf\mdmvv.inf.sos
%WINDIR%\inf\mdmwhql0.inf.sos
%WINDIR%\inf\mdmx5560.inf.sos
%WINDIR%\inf\mdmzoom.inf.sos
%WINDIR%\inf\mdmzyp.inf.sos
%WINDIR%\inf\mdmzyxel.inf.sos
%WINDIR%\inf\mdmzyxlg.inf.sos
%WINDIR%\inf\megasas.inf.sos
%WINDIR%\inf\megasas2.inf.sos
%WINDIR%\inf\megasr.inf.sos
%WINDIR%\inf\memory.inf.sos
%WINDIR%\inf\mdmusrk1.inf.sos
%WINDIR%\inf\monitor.inf.sos
%WINDIR%\syswow64\sppui\phone.inf.sos

Sets the 'hidden' attribute to the following files

%WINDIR%\syswow64\<File name>.exe
C:\users\public\documents\<File name>.exe

Deletes the following files

%WINDIR%\enterprise.xml
%WINDIR%\inf\prnep002.inf
%WINDIR%\inf\prnep003.inf
%WINDIR%\inf\prnep004.inf
%WINDIR%\inf\prnep005.inf
%WINDIR%\inf\prnep00a.inf
%WINDIR%\inf\prnep00b.inf
%WINDIR%\inf\prnep00d.inf
%WINDIR%\inf\prnca00c.inf
%WINDIR%\inf\prnep00e.inf
%WINDIR%\inf\prnep00f.inf
%WINDIR%\inf\prnep00g.inf
%WINDIR%\inf\prnep00l.inf
%WINDIR%\inf\prnfx002.inf
%WINDIR%\inf\prnge001.inf
%WINDIR%\inf\prnca00z.inf
%WINDIR%\inf\prnca00y.inf
%WINDIR%\inf\prnca00x.inf
%WINDIR%\inf\prnca00i.inf
%WINDIR%\inf\prnca00h.inf
%WINDIR%\inf\prnca00g.inf
%WINDIR%\inf\prnca00f.inf
%WINDIR%\inf\prnca00e.inf
%WINDIR%\inf\prnca00d.inf
%WINDIR%\inf\prnep00c.inf
%WINDIR%\inf\prnca00b.inf
%WINDIR%\inf\prnca00a.inf
%WINDIR%\inf\prnca003.inf
%WINDIR%\inf\prnbr00a.inf
%WINDIR%\inf\prnbr009.inf
%WINDIR%\inf\prnbr008.inf
%WINDIR%\inf\prnbr007.inf
%WINDIR%\inf\prngt002.inf
%WINDIR%\inf\prnkm003.inf
%WINDIR%\inf\prnlx00c.inf
%WINDIR%\inf\prnhp002.inf
%WINDIR%\inf\prnky009.inf
%WINDIR%\inf\prnle002.inf
%WINDIR%\inf\prnle003.inf
%WINDIR%\inf\prnle004.inf
%WINDIR%\inf\prnlx002.inf
%WINDIR%\inf\prnlx003.inf
%WINDIR%\inf\prnlx005.inf
%WINDIR%\inf\prngt003.inf
%WINDIR%\inf\prnlx006.inf
%WINDIR%\inf\prnlx007.inf
%WINDIR%\inf\prnlx008.inf
%WINDIR%\inf\prnlx009.inf
%WINDIR%\inf\prnlx00a.inf
%WINDIR%\inf\prnlx00b.inf
%WINDIR%\inf\prnky008.inf
%WINDIR%\inf\prnky007.inf
%WINDIR%\inf\prnky006.inf
%WINDIR%\inf\prnky005.inf
%WINDIR%\inf\prnky004.inf
%WINDIR%\inf\prnky003.inf
%WINDIR%\inf\prnky002.inf
%WINDIR%\inf\prnkm005.inf
%WINDIR%\inf\prnkm004.inf
%WINDIR%\inf\prnbr006.inf
%WINDIR%\inf\prnkm002.inf
%WINDIR%\inf\prnin004.inf
%WINDIR%\inf\prnin003.inf
%WINDIR%\inf\prnin002.inf
%WINDIR%\inf\prnhp005.inf
%WINDIR%\inf\prnhp004.inf
%WINDIR%\inf\prnhp003.inf
%WINDIR%\inf\prngt004.inf
%WINDIR%\inf\prnlx004.inf
%WINDIR%\inf\prnbr005.inf
%WINDIR%\inf\ph3xibc5.inf
%WINDIR%\inf\netg664.inf
%WINDIR%\inf\netimm.inf
%WINDIR%\inf\netirda.inf
%WINDIR%\inf\netk57a.inf
%WINDIR%\inf\netl160a.inf
%WINDIR%\inf\netl1c64.inf
%WINDIR%\inf\netl260a.inf
%WINDIR%\inf\net8187se64.inf
%WINDIR%\inf\netloop.inf
%WINDIR%\inf\netmyk00.inf
%WINDIR%\inf\netnvm64.inf
%WINDIR%\inf\netnvma.inf
%WINDIR%\inf\netr28ux.inf
%WINDIR%\inf\netr28x.inf
%WINDIR%\inf\netevbda.inf
%WINDIR%\inf\netefe3e.inf
%WINDIR%\inf\nete1g3e.inf
%WINDIR%\inf\nete1e3e.inf
%WINDIR%\inf\netbxnda.inf
%WINDIR%\inf\netbvbda.inf
%WINDIR%\inf\netbc664.inf
%WINDIR%\inf\netb57va.inf
%WINDIR%\inf\netathrx.inf
%WINDIR%\inf\netl1e64.inf
%WINDIR%\inf\net8187bv64.inf
%WINDIR%\inf\net8185.inf
%WINDIR%\inf\net44amd.inf
%WINDIR%\inf\net1yx64.inf
%WINDIR%\inf\net1qx64.inf
%WINDIR%\inf\net1kx64.inf
%WINDIR%\inf\multiprt.inf
%WINDIR%\inf\netr7364.inf
%WINDIR%\inf\nfrd960.inf
%WINDIR%\inf\prnbr003.inf
%WINDIR%\inf\netrtx64.inf
%WINDIR%\inf\ph3xibc10.inf
%WINDIR%\inf\ph3xibc11.inf
%WINDIR%\inf\ph3xibc12.inf
%WINDIR%\inf\ph3xibc2.inf
%WINDIR%\inf\ph3xibc3.inf
%WINDIR%\inf\ph3xibc4.inf
%WINDIR%\inf\ph3xibc6.inf
%WINDIR%\inf\netrndis.inf
%WINDIR%\inf\ph3xibc7.inf
%WINDIR%\inf\ph3xibc8.inf
%WINDIR%\inf\ph3xibc9.inf
%WINDIR%\inf\ph6xib64c0.inf
%WINDIR%\inf\ph6xib64c1.inf
%WINDIR%\inf\prnbr002.inf
%WINDIR%\inf\ph3xibc1.inf
%WINDIR%\inf\ph3xibc0.inf
%WINDIR%\inf\pcmcia.inf
%WINDIR%\inf\oem1.inf
%WINDIR%\inf\oem0.inf
%WINDIR%\inf\nv_lh.inf
%WINDIR%\inf\nvraid.inf
%WINDIR%\inf\nulhpopr.inf
%WINDIR%\inf\ntprint.inf
%WINDIR%\inf\prnbr004.inf
%WINDIR%\inf\netxfx64.inf
%WINDIR%\inf\netxex64.inf
%WINDIR%\inf\netw5v64.inf
%WINDIR%\inf\netvwifibus.inf
%WINDIR%\inf\netvg62a.inf
%WINDIR%\inf\netvfx64.inf
%WINDIR%\inf\nettun.inf
%WINDIR%\inf\netrtl64.inf
%WINDIR%\inf\prnlx00d.inf
%WINDIR%\inf\prnlx00e.inf
%WINDIR%\inf\prnlx00v.inf
%WINDIR%\inf\wiaca00d.inf
%WINDIR%\inf\wiabr008.inf
%WINDIR%\inf\wiabr009.inf
%WINDIR%\inf\wiabr00a.inf
%WINDIR%\inf\wiaca00a.inf
%WINDIR%\inf\wiaca00b.inf
%WINDIR%\inf\wiaca00c.inf
%WINDIR%\inf\wiaca00e.inf
%WINDIR%\inf\wceisvista.inf
%WINDIR%\inf\wiaca00f.inf
%WINDIR%\inf\wiaca00i.inf
%WINDIR%\inf\wiacn001.inf
%WINDIR%\inf\wiaep002.inf
%WINDIR%\inf\wiaep003.inf
%WINDIR%\inf\wiahp001.inf
%WINDIR%\inf\wiabr007.inf
%WINDIR%\inf\wiabr006.inf
%WINDIR%\inf\wiabr002.inf
%WINDIR%\inf\wdmvsc.inf
%WINDIR%\inf\wdma_usb.inf
%WINDIR%\inf\wdmaudio.inf
%WINDIR%\inf\wd.inf
%WINDIR%\inf\wave.inf
%WINDIR%\inf\usbstor.inf
%WINDIR%\inf\wiaky002.inf
%WINDIR%\inf\vsmraid.inf
%WINDIR%\inf\volume.inf
%WINDIR%\inf\volsnap.inf
%WINDIR%\inf\vhdmp.inf
%WINDIR%\inf\usbvideo.inf
%WINDIR%\inf\wiabr005.inf
%WINDIR%\inf\v_mscdsc.inf
%WINDIR%\inf\wiabr004.inf
%WINDIR%\inf\wialx002.inf
%WINDIR%\inf\wialx006.inf
%WINDIR%\inf\wvmbus.inf
%WINDIR%\inf\wvmbushid.inf
%WINDIR%\inf\wvmbusvideo.inf
%WINDIR%\inf\wvmic.inf
%WINDIR%\inf\xcbdav.inf
%WINDIR%\inf\xnacc.inf
%WINDIR%\panther\diagwrn.xml
%WINDIR%\inf\wstorvsc.inf
%WINDIR%\panther\unattend.xml
%WINDIR%\syswow64\mapisvc.inf
%WINDIR%\panther\unattendgc\diagerr.xml
%WINDIR%\panther\unattendgc\diagwrn.xml
%WINDIR%\pla\system\system diagnostics.xml
%WINDIR%\pla\system\system performance.xml
%WINDIR%\inf\wudfusbcciddriver.inf
%WINDIR%\inf\wstorflt.inf
<SYSTEM32>\catroot2\dberr.txt
%WINDIR%\inf\wiasa002.inf
%WINDIR%\inf\wiaxx002.inf
%WINDIR%\inf\windowssideshowenhanceddriver.inf
%WINDIR%\inf\winusb.inf
%WINDIR%\inf\wialx003.inf
%WINDIR%\inf\wialx005.inf
%WINDIR%\inf\wialx004.inf
%WINDIR%\inf\wnetvsc.inf
%WINDIR%\inf\wpdmtphw.inf
%WINDIR%\inf\ws3cap.inf
%WINDIR%\inf\wsdprint.inf
%WINDIR%\inf\wsdscdrv.inf
%WINDIR%\inf\wpdcomp.inf
%WINDIR%\inf\wpdfs.inf
%WINDIR%\inf\wpdmtp.inf
%WINDIR%\inf\usbprint.inf
%WINDIR%\inf\usbport.inf
%WINDIR%\inf\usbcir.inf
%WINDIR%\inf\prnrc00a.inf
%WINDIR%\inf\prnrc00b.inf
%WINDIR%\inf\prnrc00c.inf
%WINDIR%\inf\prnsa002.inf
%WINDIR%\inf\prnsh002.inf
%WINDIR%\inf\prnso002.inf
%WINDIR%\inf\prnsv003.inf
%WINDIR%\inf\ramdisk.inf
%WINDIR%\inf\prnsv004.inf
%WINDIR%\inf\prnts002.inf
%WINDIR%\inf\prnts003.inf
%WINDIR%\inf\prnxx002.inf
%WINDIR%\inf\qd3x64.inf
%WINDIR%\inf\ql2300.inf
%WINDIR%\inf\prnrc007.inf
%WINDIR%\inf\prnrc006.inf
%WINDIR%\inf\prnlx00w.inf
%WINDIR%\inf\prnnr004.inf
%WINDIR%\inf\prnrc005.inf
%WINDIR%\inf\prnrc004.inf
%WINDIR%\inf\prnrc003.inf
%WINDIR%\inf\prnrc002.inf
%WINDIR%\inf\prnok002.inf
%WINDIR%\inf\prnsv002.inf
%WINDIR%\inf\prnod002.inf
%WINDIR%\inf\ql40xx2.inf
%WINDIR%\inf\prnnr002.inf
%WINDIR%\inf\prnms002.inf
%WINDIR%\inf\prnlx00z.inf
%WINDIR%\inf\prnlx00y.inf
%WINDIR%\inf\prnlx00x.inf
%WINDIR%\inf\prnnr003.inf
%WINDIR%\inf\ql40xx.inf
%WINDIR%\inf\rawsilo.inf
%WINDIR%\inf\termkbd.inf
%WINDIR%\inf\tpm.inf
%WINDIR%\inf\transfercable.inf
%WINDIR%\inf\tsgenericusbdriver.inf
%WINDIR%\inf\tsprint.inf
%WINDIR%\inf\tdibth.inf
%WINDIR%\inf\rdlsbuscbs.inf
%WINDIR%\inf\termmou.inf
%WINDIR%\inf\tsusbhub.inf
%WINDIR%\inf\umbus.inf
%WINDIR%\inf\umpass.inf
%WINDIR%\inf\unknown.inf
%WINDIR%\inf\usb.inf
%WINDIR%\inf\tsusbhubfilter.inf
%WINDIR%\inf\ts_generic.inf
%WINDIR%\inf\ts_wpdmtp.inf
%WINDIR%\inf\sdbus.inf
%WINDIR%\inf\mtconfig.inf
%WINDIR%\inf\sti.inf
%WINDIR%\inf\stexstor.inf
%WINDIR%\inf\smartcrd.inf
%WINDIR%\inf\sisraid4.inf
%WINDIR%\inf\sisraid2.inf
%WINDIR%\inf\sffdisk.inf
%WINDIR%\inf\sensorsalsdriver.inf
%WINDIR%\inf\tape.inf
%WINDIR%\inf\scsidev.inf
%WINDIR%\inf\scrawpdo.inf
%WINDIR%\inf\sbp2.inf
%WINDIR%\inf\rndiscmp.inf
%WINDIR%\inf\ricoh.inf
%WINDIR%\inf\rdvgwddm.inf
%WINDIR%\inf\rdpbus.inf
%WINDIR%\inf\synth3dvsc.inf
%WINDIR%\panther\diagerr.xml
%WINDIR%\inf\mstape.inf
%WINDIR%\inf\modemcsa.inf
%WINDIR%\inf\igdlh.inf
%WINDIR%\inf\iirsp.inf
%WINDIR%\inf\iirsp2.inf
%WINDIR%\inf\image.inf
%WINDIR%\inf\input.inf
%WINDIR%\inf\ipmidrv.inf
%WINDIR%\inf\keyboard.inf
%WINDIR%\inf\hiddigi.inf
%WINDIR%\inf\ks.inf
%WINDIR%\inf\kscaptur.inf
%WINDIR%\inf\ksfilter.inf
%WINDIR%\inf\lsi_fc.inf
%WINDIR%\inf\lsi_sas.inf
%WINDIR%\inf\lsi_sas2.inf
%WINDIR%\inf\iastorv.inf
%WINDIR%\inf\hpsamd.inf
%WINDIR%\inf\hpoa1ss.inf
%WINDIR%\inf\hpoa1so.inf
%WINDIR%\inf\hpoa1sd.inf
%WINDIR%\inf\hpoa1nd.inf
%WINDIR%\inf\hidserv.inf
%WINDIR%\inf\hidirkbd.inf
%WINDIR%\inf\hidir.inf
%WINDIR%\inf\iscsi.inf
%WINDIR%\inf\hidbth.inf
%WINDIR%\inf\hdaudss.inf
%WINDIR%\inf\hdaudio.inf
%WINDIR%\inf\hdaudbus.inf
%WINDIR%\inf\hcw85c64.inf
%WINDIR%\inf\hcw85b64.inf
%WINDIR%\inf\hcw72b64.inf
%WINDIR%\inf\lsi_scsi.inf
%WINDIR%\inf\mdmaiwa3.inf
%WINDIR%\inf\mdmcm28.inf
%WINDIR%\inf\mcx2.inf
%WINDIR%\inf\mdmboca.inf
%WINDIR%\inf\mdmbr002.inf
%WINDIR%\inf\mdmbr004.inf
%WINDIR%\inf\mdmbr005.inf
%WINDIR%\inf\mdmbr006.inf
%WINDIR%\inf\mdmbr007.inf
%WINDIR%\inf\mdmbr00a.inf
%WINDIR%\inf\machine.inf
%WINDIR%\inf\mdmbsb.inf
%WINDIR%\inf\mdmbtmdm.inf
%WINDIR%\inf\mdmbug3.inf
%WINDIR%\inf\mdmbw561.inf
%WINDIR%\inf\mdmc26a.inf
%WINDIR%\inf\mdmcdp.inf
%WINDIR%\inf\mdmaus.inf
%WINDIR%\inf\mdmatm2k.inf
%WINDIR%\inf\mdmati.inf
%WINDIR%\inf\mdmarn.inf
%WINDIR%\inf\mdmarch.inf
%WINDIR%\inf\mdmar1.inf
%WINDIR%\inf\mdmaiwat.inf
%WINDIR%\inf\mdmaiwa5.inf
%WINDIR%\inf\mdmaiwa4.inf
%WINDIR%\inf\hal.inf
%WINDIR%\inf\mdmaiwa.inf
%WINDIR%\inf\mdmairte.inf
%WINDIR%\inf\mdmags64.inf
%WINDIR%\inf\mdmagm64.inf
%WINDIR%\inf\mdmadc.inf
%WINDIR%\inf\mdm5674a.inf
%WINDIR%\inf\mdm3com.inf
%WINDIR%\inf\mchgr.inf
%WINDIR%\inf\mdmbr008.inf
%WINDIR%\inf\gameport.inf
%WINDIR%\inf\dot4prt.inf
%WINDIR%\inf\arc.inf
%WINDIR%\inf\arcsas.inf
%WINDIR%\inf\atiilhag.inf
%WINDIR%\inf\atiriol6.inf
%WINDIR%\inf\avc.inf
%WINDIR%\inf\averfx2hbh826d_noaverir_x64.inf
%WINDIR%\inf\averfx2swtv_noavin_x64.inf
%WINDIR%\inf\adp94xx.inf
%WINDIR%\inf\averfx2swtv_x64.inf
%WINDIR%\inf\averhbh826_noaverir_x64.inf
%WINDIR%\inf\avmx64c.inf
%WINDIR%\inf\battery.inf
%WINDIR%\inf\bda.inf
%WINDIR%\inf\blbdrive.inf
%WINDIR%\inf\angelu64.inf
%WINDIR%\inf\angel64.inf
%WINDIR%\inf\angel264.inf
%WINDIR%\inf\amdsbs.inf
%WINDIR%\inf\amdsata.inf
%WINDIR%\inf\agp.inf
%WINDIR%\inf\af9035bda.inf
%WINDIR%\inf\adpu320.inf
%WINDIR%\inf\adpahci.inf
%WINDIR%\inf\averfx2hbtv_x64.inf
%WINDIR%\inf\acpipmi.inf
%WINDIR%\inf\acpi.inf
%WINDIR%\inf\61883.inf
%WINDIR%\inf\1394.inf
%WINDIR%\fonts\fms_metadata.xml
%WINDIR%\starter.xml
%WINDIR%\ocsetup_cbs_uninstall_searchengine-client-package.txt
%WINDIR%\inf\brmfcmdm.inf
%WINDIR%\inf\cdrom.inf
%WINDIR%\inf\fdc.inf
%WINDIR%\inf\brmfcumd.inf
%WINDIR%\inf\dc21x4vm.inf
%WINDIR%\inf\digitalmediadevice.inf
%WINDIR%\inf\disk.inf
%WINDIR%\inf\display.inf
%WINDIR%\inf\divacx64.inf
%WINDIR%\inf\dot4.inf
%WINDIR%\inf\eaphost.inf
%WINDIR%\inf\brmfcmf.inf
%WINDIR%\inf\ehstorcertdrv.inf
%WINDIR%\inf\ehstorpwddrv.inf
%WINDIR%\inf\elxstor.inf
%WINDIR%\inf\faxca003.inf
%WINDIR%\inf\faxcn001.inf
%WINDIR%\inf\faxcn002.inf
%WINDIR%\inf\cxraptor_philipstuv1236d_ibv64.inf
%WINDIR%\inf\cxraptor_fm1236mk5_ibv64.inf
%WINDIR%\inf\cxraptor_fm1216mk5_ibv64.inf
%WINDIR%\inf\cxfalpal_ibv64.inf
%WINDIR%\inf\cxfalcon_ibv64.inf
%WINDIR%\inf\crcdisk.inf
%WINDIR%\inf\cpu.inf
%WINDIR%\inf\compositebus.inf
%WINDIR%\inf\circlass.inf
%WINDIR%\inf\flpydisk.inf
%WINDIR%\inf\bthspp.inf
%WINDIR%\inf\bthprint.inf
%WINDIR%\inf\bthpan.inf
%WINDIR%\inf\bthmtpenum.inf
%WINDIR%\inf\bth.inf
%WINDIR%\inf\brmfport.inf
%WINDIR%\inf\brmfcwia.inf
%WINDIR%\inf\brmfcsto.inf
%WINDIR%\inf\mdmcodex.inf
%WINDIR%\inf\mdmcom1.inf
%WINDIR%\inf\mdmcommu.inf
%WINDIR%\inf\mdmsonyu.inf
%WINDIR%\inf\mdmrock3.inf
%WINDIR%\inf\mdmrock4.inf
%WINDIR%\inf\mdmrock5.inf
%WINDIR%\inf\mdmsier.inf
%WINDIR%\inf\mdmsii64.inf
%WINDIR%\inf\mdmsmart.inf
%WINDIR%\inf\mdmsun1.inf
%WINDIR%\inf\mdmoptn.inf
%WINDIR%\inf\mdmsun2.inf
%WINDIR%\inf\mdmsupr3.inf
%WINDIR%\inf\mdmsupra.inf
%WINDIR%\inf\mdmsuprv.inf
%WINDIR%\inf\mdmtdk.inf
%WINDIR%\inf\mdmtdkj2.inf
%WINDIR%\inf\mdmrock.inf
%WINDIR%\inf\mdmracal.inf
%WINDIR%\inf\mdmpn1.inf
%WINDIR%\inf\mdmpin.inf
%WINDIR%\inf\mdmpenr.inf
%WINDIR%\inf\mdmpace.inf
%WINDIR%\inf\mdmosi.inf
%WINDIR%\inf\mdmomrn3.inf
%WINDIR%\inf\mdmnttd2.inf
%WINDIR%\inf\mdmtdkj3.inf
%WINDIR%\inf\mdmnttte.inf
%WINDIR%\inf\mdmnttp2.inf
%WINDIR%\inf\mdmnttp.inf
%WINDIR%\inf\mdmnttme.inf
%WINDIR%\inf\mdmnttd6.inf
%WINDIR%\inf\mdmpsion.inf
%WINDIR%\inf\mdmolic.inf
%WINDIR%\inf\mdmpp.inf
%WINDIR%\inf\mdmtdkj4.inf
%WINDIR%\inf\mdmtexas.inf
%WINDIR%\inf\mdmzyxlg.inf
%WINDIR%\inf\megasas.inf
%WINDIR%\inf\megasas2.inf
%WINDIR%\inf\megasr.inf
%WINDIR%\inf\memory.inf
%WINDIR%\inf\mf.inf
%WINDIR%\inf\monitor.inf
%WINDIR%\inf\mdmzyp.inf
%WINDIR%\inf\mpio.inf
%WINDIR%\inf\msclmd.inf
%WINDIR%\inf\msdri.inf
%WINDIR%\inf\msdsm.inf
%WINDIR%\inf\msdv.inf
%WINDIR%\inf\mshdc.inf
%WINDIR%\inf\mdmzyxel.inf
%WINDIR%\inf\mdmzoom.inf
%WINDIR%\inf\msmouse.inf
%WINDIR%\inf\mdmti.inf
%WINDIR%\inf\mdmtkr.inf
%WINDIR%\inf\mdmtron.inf
%WINDIR%\inf\mdmusrf.inf
%WINDIR%\inf\mdmtdkj5.inf
%WINDIR%\inf\mdmtdkj7.inf
%WINDIR%\inf\mdmtdkj6.inf
%WINDIR%\inf\mdmusrg.inf
%WINDIR%\inf\mdmvdot.inf
%WINDIR%\inf\mdmvv.inf
%WINDIR%\inf\mdmwhql0.inf
%WINDIR%\inf\mdmx5560.inf
%WINDIR%\inf\mdmusrgl.inf
%WINDIR%\inf\mdmusrk1.inf
%WINDIR%\inf\mdmusrsp.inf
%WINDIR%\inf\mdmntt1.inf
%WINDIR%\inf\mdmnova.inf
%WINDIR%\inf\mdmnokia.inf
%WINDIR%\inf\mdmeric.inf
%WINDIR%\inf\mdmeric2.inf
%WINDIR%\inf\mdmetech.inf
%WINDIR%\inf\mdmfj2.inf
%WINDIR%\inf\mdmgatew.inf
%WINDIR%\inf\mdmgcs.inf
%WINDIR%\inf\mdmgl001.inf
%WINDIR%\inf\mdmgl010.inf
%WINDIR%\inf\mdmgl002.inf
%WINDIR%\inf\mdmgl003.inf
%WINDIR%\inf\mdmgl004.inf
%WINDIR%\inf\mdmgl005.inf
%WINDIR%\inf\mdmgl006.inf
%WINDIR%\inf\mdmgl007.inf
%WINDIR%\inf\mdmelsa.inf
%WINDIR%\inf\mdmeiger.inf
%WINDIR%\inf\mdmcomp.inf
%WINDIR%\inf\mdmdcm5.inf
%WINDIR%\inf\mdmdyna.inf
%WINDIR%\inf\mdmdsi.inf
%WINDIR%\inf\mdmdp2.inf
%WINDIR%\inf\mdmdgitn.inf
%WINDIR%\inf\mdmdf56f.inf
%WINDIR%\inf\mdmgen.inf
%WINDIR%\inf\mdmdcm6.inf
%WINDIR%\inf\mdmgl009.inf
%WINDIR%\inf\mdmcxhv6.inf
%WINDIR%\inf\mdmcrtix.inf
%WINDIR%\inf\mdmcpv.inf
%WINDIR%\inf\mdmcpq2.inf
%WINDIR%\inf\mdmcpq.inf
%WINDIR%\inf\mdmcxpv6.inf
%WINDIR%\inf\mdmgl008.inf
%WINDIR%\inf\mdmgsm.inf
%WINDIR%\inf\mdmmetri.inf
%WINDIR%\inf\mdmmhzel.inf
%WINDIR%\inf\mdmminij.inf
%WINDIR%\inf\mdmmod.inf
%WINDIR%\inf\mdmmot64.inf
%WINDIR%\inf\mdmmega.inf
%WINDIR%\inf\mdmhaeu.inf
%WINDIR%\inf\mdmmhrtz.inf
%WINDIR%\inf\mdmmoto1.inf
%WINDIR%\inf\mdmnis1u.inf
%WINDIR%\inf\mdmnis2u.inf
%WINDIR%\inf\mdmnis3t.inf
%WINDIR%\inf\mdmnis5t.inf
%WINDIR%\inf\mdmmotou.inf
%WINDIR%\inf\mdmmts.inf
%WINDIR%\inf\mdmneuhs.inf
%WINDIR%\inf\mdmjf56e.inf
%WINDIR%\inf\msports.inf
%WINDIR%\inf\mdmmcd.inf
%WINDIR%\inf\mdmmc288.inf
%WINDIR%\inf\mdmlucnt.inf
%WINDIR%\inf\mdmlasno.inf
%WINDIR%\inf\mdmlasat.inf
%WINDIR%\inf\mdmkortx.inf
%WINDIR%\inf\mdmke.inf
%WINDIR%\inf\mdmmct.inf
%WINDIR%\inf\mdmisdn.inf
%WINDIR%\inf\mdmirmdm.inf
%WINDIR%\inf\mdmiodat.inf
%WINDIR%\inf\mdminfot.inf
%WINDIR%\inf\mdmhayes.inf
%WINDIR%\inf\mdmhay2.inf
%WINDIR%\inf\mdmhandy.inf
%WINDIR%\inf\mdmmcom.inf
%WINDIR%\syswow64\recovery\reagent.xml

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /tn "SevenRecode" /tr "<SYSTEM32>\Winhttp.exe" /sc minute /mo 1 /rl highest /f' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C copy <Full path to file> <SYSTEM32>\<File name>.exe
'%WINDIR%\syswow64\cmd.exe' /C copy <Full path to file> C:\Users\Public\Documents\<File name>.exe
'%WINDIR%\syswow64\cmd.exe' /C attrib +h <SYSTEM32>\<File name>.exe
'%WINDIR%\syswow64\cmd.exe' /C attrib +h C:\Users\Public\Documents\<File name>.exe
'%WINDIR%\syswow64\attrib.exe' +h <SYSTEM32>\<File name>.exe
'%WINDIR%\syswow64\schtasks.exe' /create /tn "SevenRecode" /tr "<SYSTEM32>\Winhttp.exe" /sc minute /mo 1 /rl highest /f
'%WINDIR%\syswow64\attrib.exe' +h C:\Users\Public\Documents\<File name>.exe
'<SYSTEM32>\taskeng.exe' {9CEAD165-6914-4530-B631-7BEDEA6A821D} S-1-5-21-3150914307-1777937420-491476919-1000:hermeppxx\user:Interactive:[1]

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial