Trojan.Encoder.41445

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'starcat' = '<Full path to file>'

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

%ProgramFiles%\winrar\readme.txt.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\manuscript.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\formal.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\distinctive.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\defaultblackandwhite.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\classic.dotx.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\places\warn.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\form_edit.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\submit.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\utilityfunctions.js.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\elegant.dotx.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\form.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\attention.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\form.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\publicfunctions.js.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\things\splash.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\things\shovel.wav.starcat
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\validation.js.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\modern.dotx.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_greentea.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_right_over.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_left_over.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_olivegreen.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_formshomepageblank.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_country.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_casual.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_adobe.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_lightspirit.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_premium.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\thatch.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\fancy.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\traditional.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\simple.dotx.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\things\whoosh.wav.starcat
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\view.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\macroprogress.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepageslice.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_country.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\view.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepageblank.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\macroprogress.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepage.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_premium.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\header.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\validation.js.starcat
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_lightspirit.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\attention.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_texturedblue.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\response.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\publicfunctions.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_adobe.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_greentea.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_casual.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\form.js.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\background.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\background.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_olivegreen.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\header.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\header.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\utilityfunctions.js.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\things\horn.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\tab_on.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\things\can.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\background.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\tab_on.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\header.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\header.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_slateblue.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_earthy.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\main.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\header.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\tab_on.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\things\coupler.wav.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\newsprint.dotx.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_formshomepage.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\utilityfunctions.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\validation.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\submit.js.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\people\hiccup.wav.starcat
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json.starcat
%LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\default.dotx.starcat
%CommonProgramFiles%\microsoft shared\themes14\strtedge\preview.gif.starcat
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\people\whistling.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\people\giggle.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\people\mmhmm.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\people\sneeze.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\attention.gif.starcat
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\view.js.starcat
%CommonProgramFiles%\microsoft shared\themes14\refined\preview.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\quickstyles\perspective.dotx.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_slateblue.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_premium.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_velvetrose.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_texturedblue.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_earthy.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_greentea.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_lightspirit.gif.starcat
%APPDATA%\microsoft\templates\normal.dotm.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\person.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_casual.gif.starcat
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.starcat
%ProgramFiles%\microsoft office\media\cagcat10\1033\cagcat10.mml.starcat
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.starcat
%CommonProgramFiles%\microsoft shared\themes14\water\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\preview.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\people\cough.wav.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_adobe.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_olivegreen.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\submit.js.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\tab_on.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\macroprogress.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_slateblue.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\places\laser.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\places\radar.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\validation.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepageblank.gif.starcat
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formshomepagescript.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepage.gif.starcat
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.001.starcat
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.001.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\things\shot.wav.starcat
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.001.starcat
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.001.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\places\toot.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\places\vibe.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\places\buzz.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\submit.js.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\places\alarm.wav.starcat
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\manifest.json.starcat
%ProgramFiles%\microsoft office\office14\groove\sounds\people\throat.wav.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\utilityfunctions.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\publicfunctions.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_velvetrose.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_texturedblue.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\sonora\preview.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\generic.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\tab_on.gif.starcat
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\header.gif.starcat
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_earthy.gif.starcat
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\document.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\hierarchy.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\form_edit.js.starcat
%CommonProgramFiles%\microsoft shared\themes14\watermar\preview.gif.starcat
%LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\header.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\tab_on.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir6f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir8f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir9b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir9f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir50b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir51b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir23f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir10f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir7f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir8b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir7f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir49b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir6f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir51b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir9f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir17f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir11f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir48b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir48f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir18f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir1b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir2b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir50b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir2f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir10f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir12f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir9b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir11f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir13f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir35f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir33f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir6b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir5b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir6b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir27f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir22f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir25f.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_greentea.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir3b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir21f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir37f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir38f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir34f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir37f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir46f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir5b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir16f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir26f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir7b.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.starcat
%ProgramFiles%\microsoft office\templates\1033\equityreport.dotx.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir40f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir25f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir27f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir51f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir26f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir43f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir47b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir32b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir30b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir31b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir20f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir35f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir15f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir2f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir22f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir33b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir28f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir36b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir28f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir23f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir43b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir24f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir19f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir12f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir45b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir21f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir24f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir29f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir8b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir31f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir32f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir47b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir49b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir50f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir45b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir48f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir46f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir43b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir44f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir20f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir1f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir16f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir2b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir8f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir47f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir49f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir15f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir42f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir4b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir44f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir46b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir44b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir4f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir41f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir40f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir38f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir34f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir39f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir29f.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\header.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir4b.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir34b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir3b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir35b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir36f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir1b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir31f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir30f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir45f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir7b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir3f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir47f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir49f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir13f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir33f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir41f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir48b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir5f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir5f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir45f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir32f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir19f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir43f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir18f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir29b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir51f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir14f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir14f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir3f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir50f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir4f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir39f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir30f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir42f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir1f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir17f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir28b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir44b.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir36f.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir46b.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_slateblue.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepageslice.gif.starcat
%ProgramFiles%\microsoft office\templates\1033\originletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\originmergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\urbanmergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\essentialletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\urbanresume.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\urbanletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\executivenewsletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\apothecaryresume.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\orielmergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\medianresume.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\orielletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\originresume.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\apothecarynewsletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\orielmergefax.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\executiveresume.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\apothecarymergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\apothecaryletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\equitymergefax.dotx.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar.starcat
%ProgramFiles%\microsoft office\templates\1033\billingstatement.xltx.starcat
%ProgramFiles%\microsoft office\templates\1033\executivemergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\bloodpressuretracker.xltx.starcat
%ProgramFiles%\microsoft office\templates\1033\loanamortization.xltx.starcat
%ProgramFiles%\microsoft office\templates\1033\salesreport.xltx.starcat
%ProgramFiles%\microsoft office\templates\1033\office word 2003 look.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\urbanmergefax.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\medianmergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\essentialmergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\medianletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\equitymergeletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\equityletter.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\medianmergefax.dotx.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar.starcat
%ProgramFiles%\microsoft office\templates\1033\executiveletter.dotx.starcat
%ProgramFiles%\microsoft office\media\cagcat10\j0214098.wav.starcat
%ProgramFiles%\microsoft office\templates\1033\orielresume.dotx.starcat
%ProgramFiles%\microsoft office\media\office14\bullets\bd21331_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\bullets\bd10298_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02749g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.starcat
%ProgramFiles%\microsoft office\templates\1033\adjacencyresume.dotx.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0075478.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099196.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099200.gif.starcat
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_country.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\expeditn\preview.gif.starcat
%ProgramFiles%\microsoft office\media\office14\bullets\bd10297_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd15185_.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\indust\preview.gif.starcat
%ProgramFiles%\microsoft office\templates\1033\essentialresume.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\originreport.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\medianreport.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\orielreport.dotx.starcat
%CommonProgramFiles%\microsoft shared\smart tag\metconv.txt.starcat
%CommonProgramFiles%\microsoft shared\themes14\deepblue\preview.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar.starcat
%CommonProgramFiles%\microsoft shared\themes14\echo\preview.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd14538_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd15184_.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\edge\preview.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21322_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\bullets\bd15018_.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\eclipse\preview.gif.starcat
%ProgramFiles%\microsoft office\templates\1033\equityresume.dotx.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21320_.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar.starcat
%ProgramFiles%\microsoft office\office14\media\chimes.wav.starcat
%ProgramFiles%\microsoft office\templates\1033\blog.dotx.starcat
%CommonProgramFiles%\microsoft shared\themes14\arctic\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\boldstri\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\breeze\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\capsules\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\cascade\preview.gif.starcat
%ProgramFiles%\microsoft office\stationery\1033\jungle.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\axis\preview.gif.starcat
%ProgramFiles%\microsoft office\stationery\1033\judgesch.gif.starcat
%ProgramFiles%\microsoft office\stationery\1033\offisupp.gif.starcat
%ProgramFiles%\microsoft office\stationery\1033\techtool.gif.starcat
%ProgramFiles%\microsoft office\stationery\1033\currency.gif.starcat
%ProgramFiles%\microsoft office\office14\reminder.wav.starcat
%ProgramFiles%\microsoft office\media\cagcat10\elphrg01.wav.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\jce.jar.starcat
%ProgramFiles%\mozilla thunderbird\visualelements\visualelements_70.png.starcat
%ProgramFiles%\winrar\license.txt.starcat
%ProgramFiles%\winrar\whatsnew.txt.starcat
%HOMEPATH%\desktop\about.html.starcat
%HOMEPATH%\desktop\browse.html.starcat
%ProgramFiles%\mozilla thunderbird\visualelements\visualelements_150.png.starcat
%HOMEPATH%\desktop\dashborder_96.bmp.starcat
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\preview.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.starcat
%HOMEPATH%\desktop\dashborder_144.bmp.starcat
%ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.starcat
%CommonProgramFiles%\microsoft shared\grphflt\ms.png.starcat
%ProgramFiles%\winrar\rar.txt.starcat
%ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar.starcat
%ProgramFiles%\winrar\order.htm.starcat
%CommonProgramFiles%\microsoft shared\grphflt\ms.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\blends\preview.gif.starcat
%ProgramFiles%\microsoft office\office14\media\whoosh.wav.starcat
%CommonProgramFiles%\microsoft shared\themes14\concrete\preview.gif.starcat
%ProgramFiles%\microsoft office\office14\media\voltage.wav.starcat
%ProgramFiles%\microsoft office\templates\1033\timecard.xltx.starcat
%ProgramFiles%\microsoft office\templates\1033\expensereport.xltx.starcat
%ProgramFiles%\microsoft office\templates\1033\originmergefax.dotx.starcat
%ProgramFiles%\microsoft office\stationery\1033\pawprint.gif.starcat
%ProgramFiles%\microsoft office\media\office14\1033\office10.mml.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar.starcat
%ProgramFiles%\microsoft office\office14\media\wind.wav.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif.starcat
%ProgramFiles%\microsoft office\office14\media\bomb.wav.starcat
%ProgramFiles%\microsoft office\office14\media\suction.wav.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.starcat
%ProgramFiles%\microsoft office\templates\1033\personalmonthlybudget.xltx.starcat
%ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx.starcat
%ProgramFiles%\microsoft office\office14\media\camera.wav.starcat
%ProgramFiles%\microsoft office\office14\media\coin.wav.starcat
%ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.starcat
%ProgramFiles%\microsoft office\office14\media\cashreg.wav.starcat
%ProgramFiles%\microsoft office\office14\media\push.wav.starcat
%ProgramFiles%\microsoft office\office14\media\breeze.wav.starcat
%ProgramFiles%\microsoft office\office14\media\drumroll.wav.starcat
%ProgramFiles%\microsoft office\office14\media\arrow.wav.starcat
%ProgramFiles%\microsoft office\office14\media\hammer.wav.starcat
%ProgramFiles%\microsoft office\office14\media\applause.wav.starcat
%ProgramFiles%\microsoft office\media\cagcat10\j0295241.gif.starcat
%ProgramFiles%\microsoft office\media\cagcat10\j0234687.gif.starcat
%ProgramFiles%\microsoft office\media\cagcat10\j0300520.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar.starcat
%CommonProgramFiles%\microsoft shared\themes14\compass\preview.gif.starcat
%ProgramFiles%\microsoft office\office14\media\explode.wav.starcat
%ProgramFiles%\microsoft office\office14\media\type.wav.starcat
%ProgramFiles%\microsoft office\office14\media\laser.wav.starcat
%ProgramFiles%\microsoft office\media\cagcat10\j0283209.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21370_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099198.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21311_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00780l.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02074_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02082_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02055_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02201_.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02218_.gif.starcat
%ProgramFiles%\microsoft office\templates\1033\executivereport.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\fax\urbanfax.dotx.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02187_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb01741l.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02134_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00760l.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143748.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00516l.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143746.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02085_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00531l.gif.starcat
%ProgramFiles%\microsoft office\templates\1033\urbanreport.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\fax\medianfax.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\fax\equityfax.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\essentialreport.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\fax\orielfax.dotx.starcat
%ProgramFiles%\microsoft office\templates\1033\fax\originfax.dotx.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02106_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143743.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00703l.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143749.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00673l.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143750.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143754.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143758.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\satin\preview.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02214_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd14539_.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\attention.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143752.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_velvetrose.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formshomepagescript.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_texturedblue.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21309_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21336_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd10256_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02097_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21427_.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_olivegreen.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_premium.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_casual.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_earthy.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_lightspirit.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_adobe.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\menus.js.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\search.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_velvetrose.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21321_.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\form_edit.js.starcat
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.starcat
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.starcat
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21303_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21325_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21305_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143753.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\quad\preview.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd14711_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21348_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21313_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21334_.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formshomepagescript.js.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21548_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21332_.gif.starcat
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02198_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd10307_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\bullets\bd14791_.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\ripple\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\level\preview.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02845g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02742g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02740g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02743g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph00601g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099201.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099197.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01743_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01745_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01840_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01843_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099193.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099194.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03014_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01838_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099203.gif.starcat
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_country.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\layers\preview.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb02229_.gif.starcat
%ProgramFiles%\microsoft office\media\office14\lines\bd21326_.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\journal\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\profile\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\radial\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\pixel\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\papyrus\preview.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099199.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\network\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\studio\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\ice\preview.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\spring\preview.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01304g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01842_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01839_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02750g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01734_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02746g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02736g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02748g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01253_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01255g.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099195.gif.starcat
%CommonProgramFiles%\microsoft shared\themes14\iris\preview.gif.starcat
%ProgramFiles%\microsoft office\media\office14\bullets\bd10253_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099192.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099202.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\wb01750_.gif.starcat
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02752g.gif.starcat
%ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.starcat

Modifies the following files

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial