Trojan.Encoder.29729

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\software\microsoft\windows\currentversion\run] '29358316' = '%ProgramFiles(x86)%\29358316\29358316.exe'

Creates the following files on removable media

<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\elvisimp.rdf
<Drive name for removable media>:\waterlandhealthkano.rtf
<Drive name for removable media>:\guide_reorganization_mapping.xls
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\2935-readme.txt
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\block.png
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\bg_search_box.png
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\background.png
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\asm.png
<Drive name for removable media>:\browse.htm
<Drive name for removable media>:\contractualdeadlines.zip
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\military_callsigns_0311.rtf
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
<Drive name for removable media>:\trtf_matrix2012_oct.xlsx
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\excel_example.zip
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\fiche_inscription_2015.zip
<Drive name for removable media>:\contenttypes.rdf
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\sioc.rdf
<Drive name for removable media>:\swc_2009-03-02.rdf
<Drive name for removable media>:\myhrvoldhanssenbiharfamine.rtf
<Drive name for removable media>:\taxus_baccata.rdf
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\passport_pal.wmv
<Drive name for removable media>:\testwmv.wmv
<Drive name for removable media>:\productos.zip
<Drive name for removable media>:\productos.xls
<Drive name for removable media>:\calculatorworksheet.xls
<Drive name for removable media>:\contractualdeadlines.xls
<Drive name for removable media>:\removedtitles_records.xls
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\highly_cited_2001.xlsx
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\file1.ppt
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\parnas_01.jpg
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\4f0bf7ff71f28.jpg
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\calibre.png
<Drive name for removable media>:\13.jpg
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\investmentbankca_ca8.pem
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\dag2_panel1_320_ref.mov
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\cleanlyrics.png
<Drive name for removable media>:\mappingconcepthubberlin.ppt
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\about.html
<Drive name for removable media>:\ff_ot_user_guide.pdf
<Drive name for removable media>:\trivial-merge.html
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\3.jpg
<Drive name for removable media>:\delongcacert.pem
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Injects code into

the following system processes:

%WINDIR%\syswow64\explorer.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\explorer.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\delete.avi

Modifies file system

Creates the following files

%ProgramFiles(x86)%\29358316\29358316.exe
C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm
C:\far2\plugins\emenu\2935-readme.txt
C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm
C:\users\all users\sun\java\java update\jaureglist.xml
C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\1036\stintl.dll.trx_dll
C:\users\all users\sun\java\java update\2935-readme.txt
C:\far2\addons\colors\default_highlighting\2935-readme.txt
C:\far2\plugins\ftp\lib\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\1036\2935-readme.txt
C:\far2\addons\xlat\russian\2935-readme.txt
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\2935-readme.txt
C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1041\2935-readme.txt
C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\2935-readme.txt
C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\2935-readme.txt
C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\2935-readme.txt
C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\2935-readme.txt
C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\2935-readme.txt
C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm
C:\users\all users\microsoft\dbgclr\7.1\1033\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm
C:\users\all users\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll
C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm
C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm
C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm
C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm
C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm
C:\users\all users\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll
C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll
C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm
C:\users\all users\microsoft\office\uicaptions\1036\visintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\msointl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\onintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\msointl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\onintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll
C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm
C:\users\all users\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll
C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm
C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\2935-readme.txt
C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1040\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1050\2935-readme.txt
C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\2935-readme.txt
C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\2935-readme.txt
C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\2052\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\3082\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1042\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1028\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1046\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1049\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1031\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll
C:\users\all users\oracle\java\installcache_x64\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\sgres.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\visintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\stintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1033\2935-readme.txt
C:\users\all users\microsoft\msdn\7.0\1036\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll
C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn
C:\far2\addons\colors\custom_highlighting\2935-readme.txt
C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\1036\mapir.dll.trx_dll
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h
C:\users\all users\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\mapir.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d
C:\users\all users\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\onintl.rest.trx_dll
C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\2935-readme.txt
C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\2935-readme.txt
C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\2935-readme.txt
C:\users\all users\microsoft\office\uicaptions\1036\msointl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\msointl.dll.trx_dll
C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm
C:\users\all users\microsoft\office\uicaptions\1036\sgres.dll.trx_dll
C:\users\all users\oracle\java\installcache_x64\baseimagefam8
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck
C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w
C:\users\all users\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll
C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d
C:\users\all users\microsoft\office\uicaptions\1036\onintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll
C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm
C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm
C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm
C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log
C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw
C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw
C:\far2\plugins\align\2935-readme.txt
C:\far2\pluginsdk\headers.pas\2935-readme.txt
C:\far2\plugins\brackets\2935-readme.txt
C:\far2\plugins\compare\2935-readme.txt
C:\far2\pluginsdk\headers.c\2935-readme.txt
C:\far2\plugins\macroview\2935-readme.txt
C:\far2\plugins\network\2935-readme.txt
C:\users\all users\mozilla\logs\2935-readme.txt
C:\far2\plugins\arclite\2935-readme.txt
C:\users\all users\microsoft help\nslist.hxl
C:\far2\encyclopedia\tap\2935-readme.txt
C:\far2\plugins\hlfviewer\2935-readme.txt
C:\far2\documentation\eng\2935-readme.txt
C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\2935-readme.txt
C:\far2\plugins\editcase\2935-readme.txt
C:\far2\plugins\drawline\2935-readme.txt
C:\far2\plugins\farcmds\2935-readme.txt
C:\far2\plugins\autowrap\2935-readme.txt
C:\far2\plugins\filecase\2935-readme.txt
C:\far2\addons\macros\2935-readme.txt
C:\far2\plugins\tmppanel\2935-readme.txt
C:\users\all users\microsoft\rac\publisheddata\racwmidatabase.sdf
C:\users\all users\microsoft\network\downloader\qmgr1.dat
C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\cache.dat
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\2935-readme.txt
C:\users\all users\microsoft help\hx.hxn
%HOMEPATH%\favorites\windows live\2935-readme.txt
%HOMEPATH%\searches\2935-readme.txt
C:\totalcmd\2935-readme.txt
%HOMEPATH%\2935-readme.txt
%HOMEPATH%\contacts\2935-readme.txt
%HOMEPATH%\desktop\2935-readme.txt
C:\users\all users\ntuser.pol
C:\users\all users\2935-readme.txt
C:\users\all users\microsoft\mf\active.grl
C:\users\all users\microsoft\user account pictures\guest.bmp
C:\users\all users\microsoft\user account pictures\user.bmp
C:\users\all users\microsoft\mf\2935-readme.txt
C:\users\public\libraries\2935-readme.txt
C:\far2\encyclopedia\2935-readme.txt
C:\far2\addons\2935-readme.txt
C:\users\all users\microsoft\network\downloader\qmgr0.dat
C:\users\public\music\sample music\2935-readme.txt
C:\far2\addons\shell\2935-readme.txt
C:\users\public\pictures\sample pictures\2935-readme.txt
C:\users\all users\microsoft\user account pictures\2935-readme.txt
C:\users\default\2935-readme.txt
%HOMEPATH%\favorites\msn websites\2935-readme.txt
C:\totalcmd\language\2935-readme.txt
C:\users\all users\microsoft toolkit\settings.xml
C:\users\all users\microsoft toolkit\2935-readme.txt
C:\users\all users\microsoft\ilscache\imcrcache.xml
C:\users\all users\microsoft\ilscache\2935-readme.txt
C:\users\all users\microsoft\mf\pending.grl
C:\users\all users\microsoft\ilscache\ilrcache.xml
C:\far2\fexcept\2935-readme.txt
%HOMEPATH%\favorites\links for united states\2935-readme.txt
%HOMEPATH%\favorites\microsoft websites\2935-readme.txt
C:\far2\2935-readme.txt
%HOMEPATH%\favorites\links\2935-readme.txt
C:\users\all users\mozilla\logs\maintenanceservice-install.log
C:\users\all users\microsoft\windows defender\support\mplog-07132009-221054.log
C:\users\all users\microsoft help\ms.dexplore.hxn
C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck
C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn
C:\users\all users\microsoft help\ms.msouc.14.1033.hxn
C:\users\all users\microsoft help\ms.mstore.14.1033.hxn
C:\users\all users\microsoft help\ms.groove.14.1033.hxn
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd
C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh
C:\users\all users\microsoft help\ms.ois.14.1033.hxn
C:\users\all users\microsoft help\ms.onenote.14.1033.hxn
C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn
C:\far2\addons\xlat\2935-readme.txt
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw
C:\users\all users\microsoft\rac\statedata\racdatabase.sdf
C:\users\all users\microsoft help\ms.setlang.14.1033.hxn
C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw
C:\users\all users\microsoft help\hx_1033_mvalidator.hxd
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw
C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm
C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm
C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm
C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn
C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat
C:\users\all users\microsoft\rac\statedata\2935-readme.txt
C:\users\all users\microsoft\assistance\client\1.0\en-us\2935-readme.txt
C:\2935-readme.txt
C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn
C:\users\all users\microsoft\windows defender\support\2935-readme.txt
C:\far2\plugins\ftp\2935-readme.txt
C:\users\all users\microsoft\network\downloader\2935-readme.txt
C:\users\public\videos\sample videos\2935-readme.txt
C:\users\all users\microsoft\crypto\keys\2935-readme.txt
C:\users\public\recorded tv\sample media\2935-readme.txt
C:\far2\documentation\rus\2935-readme.txt
C:\far2\plugins\proclist\2935-readme.txt
C:\users\all users\microsoft help\2935-readme.txt
C:\far2\addons\setup\2935-readme.txt
C:\far2\addons\colors\2935-readme.txt
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw
C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd
C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn
C:\users\all users\microsoft help\ms.winword.14.1033.hxn
C:\users\all users\microsoft help\ms.excel.14.1033.hxn
C:\users\all users\microsoft\rac\statedata\racmetadata.dat
C:\users\all users\microsoft help\ms.graph.14.1033.hxn
C:\users\all users\microsoft help\ms.infopath.14.1033.hxn
C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn
C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn
C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn
C:\users\all users\microsoft help\ms.mspub.14.1033.hxn
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw
C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd
C:\users\all users\microsoft help\ms.outlook.14.1033.hxn
C:\users\all users\microsoft\rac\publisheddata\2935-readme.txt
C:\users\all users\microsoft help\hx_1033_mvalidator.lck
D:\2935-readme.txt

Sets the 'hidden' attribute to the following files

C:\users\all users\ntuser.pol.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.onenote.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.outlook.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.setlang.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.mspub.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\hx_1033_mvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\hx.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\nslist.hxl.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.excel.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.infopath.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.graph.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.ois.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.winword.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.dexplore.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.groove.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\hx_1033_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.mstore.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.msouc.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w.mailto[kkkwwwsvvv@cock.li].2935

Deletes the following files

%ProgramFiles(x86)%\29358316\29358316.exe

Moves the following files

from C:\users\all users\ntuser.pol to C:\users\all users\ntuser.pol.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\msointl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\msointl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\onintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\onintl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\rac\statedata\racmetadata.dat to C:\users\all users\microsoft\rac\statedata\racmetadata.dat.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm to C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\sun\java\java update\jaureglist.xml to C:\users\all users\sun\java\java update\jaureglist.xml.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\stintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\stintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\msointl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\msointl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini to C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\visintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\visintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\onintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\onintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm to C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q to C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\mapir.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\mapir.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\sgres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\sgres.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\visintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\visintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\stintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\stintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\onintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\onintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\msointl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\msointl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\sgres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\sgres.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\mapir.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\mapir.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\onintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\onintl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\oracle\java\installcache_x64\baseimagefam8 to C:\users\all users\oracle\java\installcache_x64\baseimagefam8.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\msointl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\msointl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm to C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini to C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm to C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.graph.14.1033.hxn to C:\users\all users\microsoft help\ms.graph.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.infopath.14.1033.hxn to C:\users\all users\microsoft help\ms.infopath.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn to C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn to C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.mspub.14.1033.hxn to C:\users\all users\microsoft help\ms.mspub.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd to C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.excel.14.1033.hxn to C:\users\all users\microsoft help\ms.excel.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn to C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.winword.14.1033.hxn to C:\users\all users\microsoft help\ms.winword.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.outlook.14.1033.hxn to C:\users\all users\microsoft help\ms.outlook.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\network\downloader\qmgr1.dat to C:\users\all users\microsoft\network\downloader\qmgr1.dat.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\network\downloader\qmgr0.dat to C:\users\all users\microsoft\network\downloader\qmgr0.dat.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\user account pictures\guest.bmp to C:\users\all users\microsoft\user account pictures\guest.bmp.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\user account pictures\user.bmp to C:\users\all users\microsoft\user account pictures\user.bmp.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft toolkit\settings.xml to C:\users\all users\microsoft toolkit\settings.xml.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\ilscache\imcrcache.xml to C:\users\all users\microsoft\ilscache\imcrcache.xml.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\ilscache\ilrcache.xml to C:\users\all users\microsoft\ilscache\ilrcache.xml.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\mf\pending.grl to C:\users\all users\microsoft\mf\pending.grl.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\cache.dat to C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\cache.dat.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\mf\active.grl to C:\users\all users\microsoft\mf\active.grl.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\mozilla\logs\maintenanceservice-install.log to C:\users\all users\mozilla\logs\maintenanceservice-install.log.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log to C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw to C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw to C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\rac\publisheddata\racwmidatabase.sdf to C:\users\all users\microsoft\rac\publisheddata\racwmidatabase.sdf.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\nslist.hxl to C:\users\all users\microsoft help\nslist.hxl.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\windows defender\support\mplog-07132009-221054.log to C:\users\all users\microsoft\windows defender\support\mplog-07132009-221054.log.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\hx.hxn to C:\users\all users\microsoft help\hx.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm to C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck to C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm to C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm to C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm to C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat to C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm to C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm to C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm to C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm to C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm to C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm to C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm to C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm to C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm to C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm to C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\hx_1033_mvalidator.hxd to C:\users\all users\microsoft help\hx_1033_mvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.msouc.14.1033.hxn to C:\users\all users\microsoft help\ms.msouc.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.mstore.14.1033.hxn to C:\users\all users\microsoft help\ms.mstore.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.dexplore.hxn to C:\users\all users\microsoft help\ms.dexplore.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh to C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\hx_1033_mvalidator.lck to C:\users\all users\microsoft help\hx_1033_mvalidator.lck.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn to C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.groove.14.1033.hxn to C:\users\all users\microsoft help\ms.groove.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.onenote.14.1033.hxn to C:\users\all users\microsoft help\ms.onenote.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\rac\statedata\racdatabase.sdf to C:\users\all users\microsoft\rac\statedata\racdatabase.sdf.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.setlang.14.1033.hxn to C:\users\all users\microsoft help\ms.setlang.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat to C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft help\ms.ois.14.1033.hxn to C:\users\all users\microsoft help\ms.ois.14.1033.hxn.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm to C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm.mailto[kkkwwwsvvv@cock.li].2935
from C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll.mailto[kkkwwwsvvv@cock.li].2935

Deletes itself.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)

Executes the following

'%WINDIR%\syswow64\explorer.exe'
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv
'%WINDIR%\syswow64\notepad.exe' %HOMEPATH%\Desktop\2935-Readme.txt

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial