Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\494bf419e40d26ec80a426c8fc08f5e8_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting.map
- %ProgramFiles%\microsoft office\office14\samples\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\samples\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\sw5mb1bhdghxzwxjb21lsw1hz2uuanbn.encrypted
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\groove\toolbmps\tg9naw5eawfsb2dcywnrz3jvdw5klmpwzw==.encrypted
- %ProgramFiles%\microsoft office\office14\groove\toolbmps\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\groove\toolbmps\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\ufnsq0hmvfmurefu.encrypted
- %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\t1vurk9sts5eqvq=.encrypted
- %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\1033\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\t0nssemurefu.encrypted
- %ProgramFiles%\microsoft office\office14\te9ps1vqlkrbva==.encrypted
- %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\decryption_ids.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\how to recovery files.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\decryption_ids.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\how to recovery files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\decryption_ids.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\how to recovery files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\how to recovery files.txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njmuslbh.encrypted
- %ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\decryption_ids.txt
- %ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\how to recovery files.txt
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting.map
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\decryption_ids.txt
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\how to recovery files.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\uegwmjgyououslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodczmzcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi4mzyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaymjc1ntguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxnzc4mdyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxndkxmtguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxndg3ntcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxnduymtiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjawotkxoteuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjawotkxnjyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\decryption_ids.txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\how to recovery files.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting.map
- %ProgramFiles%\java\jre1.8.0_45\lib\decryption_ids.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\how to recovery files.txt
- %ALLUSERSPROFILE%\key
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndquslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq5mdauslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4otuuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4odguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4oduuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5nzauslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njkuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njyuslbh.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decryption_ids.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\decryption_ids.txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njeuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntkuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntuuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntquslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntauslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\qwrvymvjrc5wzgy=.encrypted
Deletes the following files
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting.map
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting.map
- %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting.map
- %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting.map
Moves the following files
- from %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat to %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\revtsudorviut05f.encrypted
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qlvtsu5fu1mut05f.encrypted
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qkxbtksut05f.encrypted
- from %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf to %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\uexbtk5fulmut05f.encrypted
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting
- from %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting to %ProgramFiles%\microsoft office\office14\samples\u09mvlnbtvauwext.encrypted
- from %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls to %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting
- from %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting to %ProgramFiles%\microsoft office\office14\1033\ufnsq0htuk4urefu.encrypted
- from %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat to %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting
- from %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting to %ProgramFiles%\microsoft office\office14\1033\ufnsq0hmrvgurefu.encrypted
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting
- from %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting to %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\u3luy2hyb25pemf0aw9urxvsys5ydgy=.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\u3rhbmrhcmrcdxnpbmvzcy5wzgy=.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\v29yzhmucgrm.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\slncexrlq29kzvdpbi5iaw4=.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\c25hchnob3rfymxvyi5iaw4=.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\bmf0axzlc19ibg9ilmjpbg==.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmxziwmf9wzxjjzw50lnbhaw==.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmxzewmf9wzxjjzw50lnbhaw==.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmlnbhaw==.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\uergu2lnuuzvcm1hbfjlcc5wzgy=.encrypted
- from %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat to %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting
- from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qunbrevnsumut05f.encrypted
- from %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting to %ProgramFiles%\microsoft office\office14\1033\ufnsq0hlrvkurefu.encrypted
- from %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat to %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting
- from %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting to %ProgramFiles%\microsoft office\office14\1033\qunusvaxmc5itfa=.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndguslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzkuslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzeuslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzauslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjcuslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjuuslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting
- from %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting to %ProgramFiles%\java\jre1.8.0_45\lib\dhpkyi5kyxq=.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\zwrpdf9wzgzfcg9zdgvymnguanbn.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\mtq5ndg3memtotkxmi1dmtg0ltrdqzktqjqwms1bntngneq4reuyotaucgrm.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntguslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntcuslbh.encrypted
- from %ProgramFiles%\microsoft office\office14\1033\actip10.hlp to %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting
- from %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting to %ProgramFiles%\microsoft office\office14\t1vutezmvfiurefu.encrypted
- from %ProgramFiles%\microsoft office\office14\outlfltr.dat to %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting
- from %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting to %ProgramFiles%\microsoft office\office14\ru5hreldlkrbva==.encrypted
- from %ProgramFiles%\microsoft office\office14\engdic.dat to %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\uegwmta0nkouslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4njiuslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njguslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njuuslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njiuslbh.encrypted
- from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njauslbh.encrypted
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\icudt26l.dat.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\awn1zhqynmwuzgf0.encrypted
Modifies the following files
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382959.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382955.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382954.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382952.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382950.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382947.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382944.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382942.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382938.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382926.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382836.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0227558.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0177806.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0149118.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0148757.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0145212.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099191.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099166.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382961.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
