Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dtffkggw
Creates the following files on removable media
- <Drive name for removable media>:\how to restore your tcvjuo files.txt
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\1189.jpg
- <Drive name for removable media>:\13.jpg
- <Drive name for removable media>:\3.jpg
- <Drive name for removable media>:\4f0bf7ff71f28.jpeg
- <Drive name for removable media>:\asaprojectcompetition.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Creates and executes a large number of processes from analysed file.
Modifies file system
Creates the following files
- %WINDIR%\temp\sqaw.bat
- %ProgramFiles%\mozilla thunderbird\features\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\defaults\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\defaults\pref\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\defaults\messenger\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\chrome\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\chrome\icons\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\chrome\icons\default\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\visualelements\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\how to restore your tcvjuo files.txt
- %ProgramFiles%\microsoft office\office16\onenote\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\uninstall\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\fonts\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\distibution\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\defaults\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\defaults\pref\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\browser\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\browser\features\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\browser\visualelements\how to restore your tcvjuo files.txt
- %ProgramFiles%\microsoft office\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla firefox\gmp-clearkey\how to restore your tcvjuo files.txt
- %ProgramFiles%\microsoft office\office16\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\fonts\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows media player\media renderer\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows security\browsercore\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows security\browsercore\en-us\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows photo viewer\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows photo viewer\en-us\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows multimedia platform\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows media player\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows media player\en-us\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows media player\visualizations\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows media player\skins\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\uninstall\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\isp\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows mail\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows defender.bak\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows defender.bak\en-us\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows defender.bak\offline\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows defender advanced threat protection\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows defender advanced threat protection\en-us\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows defender advanced threat protection\classification\how to restore your tcvjuo files.txt
- %ProgramFiles%\winrar\how to restore your tcvjuo files.txt
- %ProgramFiles%\mozilla thunderbird\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows media player\network sharing\how to restore your tcvjuo files.txt
- %ProgramFiles%\microsoft office\office16\1033\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- D:\how to restore your tcvjuo files.txt
- %WINDIR%\temp\sdzjzgliyxw.dll
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\applet\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\security\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\management\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\jfr\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\images\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\fonts\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\ext\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\deploy\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\cmm\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\amd64\how to restore your tcvjuo files.txt
- C:\msocache\all users\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\bin\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\bin\server\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\bin\plugin2\how to restore your tcvjuo files.txt
- %ProgramFiles%\java\jre1.8.0_77\bin\dtplugin\how to restore your tcvjuo files.txt
- %ProgramFiles%\internet explorer\how to restore your tcvjuo files.txt
- %ProgramFiles%\internet explorer\images\how to restore your tcvjuo files.txt
- %ProgramFiles%\internet explorer\en-us\how to restore your tcvjuo files.txt
- %ProgramFiles%\internet explorer\signup\how to restore your tcvjuo files.txt
- C:\msocache\how to restore your tcvjuo files.txt
- %ProgramFiles%\windows security\how to restore your tcvjuo files.txt
- nul
Moves the following files
- from %ProgramFiles%\internet explorer\signup\install.ins to %ProgramFiles%\internet explorer\signup\install.ins.tcvjuo
- from %ProgramFiles%\microsoft office\office16\onenote\prnms006.inf to %ProgramFiles%\microsoft office\office16\onenote\prnms006.inf.tcvjuo
- from %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd to %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd.tcvjuo
- from %ProgramFiles%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi.tcvjuo
- from %ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd to %ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd.tcvjuo
- from %ProgramFiles%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi.tcvjuo
- from %ProgramFiles%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi.tcvjuo
- from %ProgramFiles%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi.tcvjuo
- from %ProgramFiles%\mozilla firefox\install.log to %ProgramFiles%\mozilla firefox\install.log.tcvjuo
- from %ProgramFiles%\mozilla firefox\accessible.tlb to %ProgramFiles%\mozilla firefox\accessible.tlb.tcvjuo
- from %ProgramFiles%\microsoft office\office16\visiocustom.propdesc to %ProgramFiles%\microsoft office\office16\visiocustom.propdesc.tcvjuo
- from %ProgramFiles%\mozilla firefox\dependentlibs.list to %ProgramFiles%\mozilla firefox\dependentlibs.list.tcvjuo
- from %ProgramFiles%\mozilla firefox\distibution\policies.json to %ProgramFiles%\mozilla firefox\distibution\policies.json.tcvjuo
- from %ProgramFiles%\mozilla firefox\firefox.exe.sig to %ProgramFiles%\mozilla firefox\firefox.exe.sig.tcvjuo
- from %ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf to %ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf.tcvjuo
- from %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js to %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js.tcvjuo
- from %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig to %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig.tcvjuo
- from %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json to %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json.tcvjuo
- from %ProgramFiles%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi.tcvjuo
- from %ProgramFiles%\mozilla firefox\browser\omni.ja to %ProgramFiles%\mozilla firefox\browser\omni.ja.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja.tcvjuo
- from %ProgramFiles%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy to %ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_77\lib\resources.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\rt.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs to %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy to %ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy.tcvjuo
- from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat.tcvjuo
- from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf.tcvjuo
- from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\sound.properties to %ProgramFiles%\java\jre1.8.0_77\lib\sound.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_77\lib\tzmappings.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\release to %ProgramFiles%\java\jre1.8.0_77\release.tcvjuo
- from %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt to %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt.tcvjuo
- from %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt to %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt.tcvjuo
- from %ProgramFiles%\microsoft office\office16\custom.propdesc to %ProgramFiles%\microsoft office\office16\custom.propdesc.tcvjuo
- from %ProgramFiles%\microsoft office\office16\mso example setup file a.txt to %ProgramFiles%\microsoft office\office16\mso example setup file a.txt.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\java.security to %ProgramFiles%\java\jre1.8.0_77\lib\security\java.security.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties.tcvjuo
- from %ProgramFiles%\mozilla firefox\installation_telemetry.json to %ProgramFiles%\mozilla firefox\installation_telemetry.json.tcvjuo
- from %ProgramFiles%\mozilla firefox\removed-files to %ProgramFiles%\mozilla firefox\removed-files.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\precomplete to %ProgramFiles%\mozilla thunderbird\precomplete.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\removed-files to %ProgramFiles%\mozilla thunderbird\removed-files.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\uninstall\uninstall.log to %ProgramFiles%\mozilla thunderbird\uninstall\uninstall.log.tcvjuo
- from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\default.sfx.tcvjuo
- from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-summary-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-summary-dialog.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\isp\spamassassin.sfd to %ProgramFiles%\mozilla thunderbird\isp\spamassassin.sfd.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\isp\spampal.sfd to %ProgramFiles%\mozilla thunderbird\isp\spampal.sfd.tcvjuo
- from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\descript.ion.tcvjuo
- from %ProgramFiles%\winrar\rarfiles.lst to %ProgramFiles%\winrar\rarfiles.lst.tcvjuo
- from %ProgramFiles%\winrar\readme.txt to %ProgramFiles%\winrar\readme.txt.tcvjuo
- from %ProgramFiles%\winrar\uninstall.lst to %ProgramFiles%\winrar\uninstall.lst.tcvjuo
- from %ProgramFiles%\winrar\whatsnew.txt to %ProgramFiles%\winrar\whatsnew.txt.tcvjuo
- from %ProgramFiles%\winrar\wincon.sfx to %ProgramFiles%\winrar\wincon.sfx.tcvjuo
- from %ProgramFiles%\winrar\wincon64.sfx to %ProgramFiles%\winrar\wincon64.sfx.tcvjuo
- from %ProgramFiles%\winrar\winrar.chm to %ProgramFiles%\winrar\winrar.chm.tcvjuo
- from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\license.txt.tcvjuo
- from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\rar.txt.tcvjuo
- from %ProgramFiles%\mozilla firefox\plugin-container.exe.sig to %ProgramFiles%\mozilla firefox\plugin-container.exe.sig.tcvjuo
- from %ProgramFiles%\mozilla firefox\omni.ja to %ProgramFiles%\mozilla firefox\omni.ja.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\isp\bogofilter.sfd to %ProgramFiles%\mozilla thunderbird\isp\bogofilter.sfd.tcvjuo
- from %ProgramFiles%\mozilla firefox\uninstall\uninstall.log to %ProgramFiles%\mozilla firefox\uninstall\uninstall.log.tcvjuo
- from %ProgramFiles%\mozilla firefox\xul.dll.sig to %ProgramFiles%\mozilla firefox\xul.dll.sig.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\accessible.tlb to %ProgramFiles%\mozilla thunderbird\accessible.tlb.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\addressbookwindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\addressbookwindow.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-alarm-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-alarm-dialog.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\isp\popfile.sfd to %ProgramFiles%\mozilla thunderbird\isp\popfile.sfd.tcvjuo
- from %ProgramFiles%\mozilla firefox\precomplete to %ProgramFiles%\mozilla firefox\precomplete.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\isp\dspam.sfd to %ProgramFiles%\mozilla thunderbird\isp\dspam.sfd.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-dialog.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\msgcomposewindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\msgcomposewindow.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js to %ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\dependentlibs.list to %ProgramFiles%\mozilla thunderbird\dependentlibs.list.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\features\wetransfer@extensions.thunderbird.net.xpi to %ProgramFiles%\mozilla thunderbird\features\wetransfer@extensions.thunderbird.net.xpi.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf to %ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\install.log to %ProgramFiles%\mozilla thunderbird\install.log.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-summary-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-summary-dialog.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-dialog.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-dialog.ico.tcvjuo
- from %ProgramFiles%\mozilla thunderbird\chrome\icons\default\messengerwindow.ico to %ProgramFiles%\mozilla thunderbird\chrome\icons\default\messengerwindow.ico.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\net.properties to %ProgramFiles%\java\jre1.8.0_77\lib\net.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\meta-index to %ProgramFiles%\java\jre1.8.0_77\lib\meta-index.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\license to %ProgramFiles%\java\jre1.8.0_77\license.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\readme.txt to %ProgramFiles%\java\jre1.8.0_77\readme.txt.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl to %ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\currency.data to %ProgramFiles%\java\jre1.8.0_77\lib\currency.data.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\copyright to %ProgramFiles%\java\jre1.8.0_77\copyright.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\classlist to %ProgramFiles%\java\jre1.8.0_77\lib\classlist.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties to %ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar to %ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jce.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_77\lib\logging.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template to %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties to %ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template to %ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar to %ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties.tcvjuo
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf.tcvjuo
- from %ProgramFiles%\winrar\zip.sfx to %ProgramFiles%\winrar\zip.sfx.tcvjuo
- from %ProgramFiles%\winrar\zip64.sfx to %ProgramFiles%\winrar\zip64.sfx.tcvjuo
Modifies the following files
- <Drive name for removable media>:\000814251_video_01.avi.tcvjuo
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab.tcvjuo
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab.tcvjuo
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.tcvjuo
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.tcvjuo
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi.tcvjuo
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.tcvjuo
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.tcvjuo
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.tcvjuo
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.tcvjuo
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.tcvjuo
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.tcvjuo
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.tcvjuo
- <Drive name for removable media>:\roozenedowebinar.pptx.tcvjuo
- <Drive name for removable media>:\waterresourcesag.pptx.tcvjuo
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.tcvjuo
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.tcvjuo
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.tcvjuo
- <Drive name for removable media>:\gruenspecht_02172016.pptx.tcvjuo
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.tcvjuo
- <Drive name for removable media>:\asaprojectcompetition.pptx.tcvjuo
- D:\install.log.tcvjuo
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.tcvjuo
- <Drive name for removable media>:\1189.jpg.tcvjuo
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab.tcvjuo
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.tcvjuo
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%WINDIR%\temp\sqaw.bat"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Admin"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client-Streamingux/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationSrcPrefetch"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPlatform"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPipeline"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Virtual Applications"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationMediaEngine"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationMP4"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationDeviceProxy"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationDS"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationContentProtection"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationAsyncWrapper"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPerformanceCore"
- '<SYSTEM32>\wevtutil.exe' CL "DirectShowPluginControl"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-SharedPerformance/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Agent Driver/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Agent Driver/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Admin/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-RMS-MSIPC/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-MSHTML/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-IEFRAME/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-OneCore-Setup/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-JSDumpHeap/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-IEFRAME/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-IE/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "MedaFoundationVideoProcD3D"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPerformance"
- '<SYSTEM32>\wevtutil.exe' CL "MedaFoundationVideoProc"
- '<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationFrameServer"
- '<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationDeviceProxy"
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=unbounded
- '<SYSTEM32>\wevtutil.exe' CL "Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "AirSpaceChannel"
- '<SYSTEM32>\wevtutil.exe' CL "AMSI/Debug"
- '<SYSTEM32>\wevtutil.exe' EL
- '<SYSTEM32>\cmd.exe' /c WEVTUTIL EL
- '<SYSTEM32>\sc.exe' stop VSS
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=401MB
- '<SYSTEM32>\wevtutil.exe' CL "DebugChannel"
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
- '<SYSTEM32>\timeout.exe' /T 5
- '<SYSTEM32>\sc.exe' start vss
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-IPC/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Admin"
- '<SYSTEM32>\wevtutil.exe' CL "DirectShowFilterGraph"
- '<SYSTEM32>\wevtutil.exe' CL "EndpointMapper"
- '<SYSTEM32>\wevtutil.exe' CL "Application"
- '<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationDeviceMFT"
- '<SYSTEM32>\wevtutil.exe' CL "Key Management Service"
- '<SYSTEM32>\wevtutil.exe' CL "Internet Explorer"
- '<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-I2C/Performance"
- '<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-I2C/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-GPIO2/Performance"
- '<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-GPIO2/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS-I2C/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS-GPIO/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "IHM_DebugChannel"
- '<SYSTEM32>\wevtutil.exe' CL "HardwareEvents"
- '<SYSTEM32>\wevtutil.exe' CL "General Logging"
- '<SYSTEM32>\wevtutil.exe' CL "ForwardedEvents"
- '<SYSTEM32>\wevtutil.exe' CL "FirstUXPerf-Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Els_Hyphenation/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
