Trojan.Encoder.39052

Technical Information

Modifies file system

Creates the following files

<Current directory>\image.jpg
%ProgramFiles%\microsoft office\office16\1033\mapishellr.dll.aos
%ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt.aos
%ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt.aos
%ProgramFiles%\microsoft office\office16\1033\ocapires.dll.aos
%ProgramFiles%\microsoft office\office16\1033\ochelperresource.dll.aos
%ProgramFiles%\microsoft office\office16\1033\ocpubres.dll.aos
%ProgramFiles%\microsoft office\office16\1033\ucaddinres.dll.aos
%ProgramFiles%\microsoft office\office16\1033\uccapires.dll.aos
%ProgramFiles%\microsoft office\office16\onenote\prnms006.inf.aos
%ProgramFiles%\microsoft office\office16\1033\grooveintlresource.dll.aos
%ProgramFiles%\microsoft office\office16\1033\lyncdesktopresources.dll.aos
%ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat.aos
%ProgramFiles%\microsoft office\office16\onenote\sendtoonenote-manifest.ini.aos
%ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd.aos
%ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.ini.aos
%ProgramFiles%\microsoft office\office16\onenote\sendtoonenotefilter.dll.aos
%ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd.aos
%ProgramFiles%\mozilla firefox\accessible.tlb.aos
%ProgramFiles%\mozilla firefox\accessiblehandler.dll.aos
%ProgramFiles%\mozilla firefox\accessiblemarshal.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-core-file-l1-2-0.dll.aos
%ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat.aos
%ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf.aos
%ProgramFiles%\microsoft office\office16\1033\bhointl.dll.aos
%ProgramFiles%\microsoft office\office16\visiocustom.propdesc.aos
%ProgramFiles%\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar.aos
%ProgramFiles%\microsoft office\office16\appsharingchromehook64.dll.aos
%ProgramFiles%\microsoft office\office16\appsharinghookcontroller64.exe.aos
%ProgramFiles%\microsoft office\office16\custom.propdesc.aos
%ProgramFiles%\microsoft office\office16\grooveex.dll.aos
%ProgramFiles%\microsoft office\office16\ieawsdc.dll.aos
%ProgramFiles%\microsoft office\office16\mapishell.dll.aos
%ProgramFiles%\microsoft office\office16\meetingjoinaxoc.dll.aos
%ProgramFiles%\microsoft office\office16\mso example setup file a.txt.aos
%ProgramFiles%\microsoft office\office16\msohev.dll.aos
%ProgramFiles%\microsoft office\office16\msohevi.dll.aos
%ProgramFiles%\microsoft office\office16\msohtmed.exe.aos
%ProgramFiles%\microsoft office\office16\msoia.exe.aos
%ProgramFiles%\microsoft office\office16\msoianetutil.dll.aos
%ProgramFiles%\microsoft office\office16\nameext.dll.aos
%ProgramFiles%\microsoft office\office16\ochelper.dll.aos
%ProgramFiles%\microsoft office\office16\olkfstub.dll.aos
%ProgramFiles%\microsoft office\office16\onbttnie.dll.aos
%ProgramFiles%\microsoft office\office16\onbttnielinkednotes.dll.aos
%ProgramFiles%\microsoft office\office16\onfilter.dll.aos
%ProgramFiles%\microsoft office\office16\onlntcomlib.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-core-file-l2-1-0.dll.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar.aos
%ProgramFiles%\microsoft office\office16\visshe.dll.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy.aos
%ProgramFiles%\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll.aos
%ProgramFiles%\mozilla firefox\ia2marshal.dll.aos
%ProgramFiles%\mozilla firefox\install.log.aos
%ProgramFiles%\mozilla firefox\installation_telemetry.json.aos
%ProgramFiles%\mozilla firefox\lgpllibs.dll.aos
%ProgramFiles%\mozilla firefox\libegl.dll.aos
%ProgramFiles%\mozilla firefox\libglesv2.dll.aos
%ProgramFiles%\mozilla firefox\locale.ini.aos
%ProgramFiles%\mozilla firefox\maintenanceservice.exe.aos
%ProgramFiles%\mozilla firefox\maintenanceservice_installer.exe.aos
%ProgramFiles%\mozilla firefox\minidump-analyzer.exe.aos
%ProgramFiles%\mozilla firefox\mozavcodec.dll.aos
%ProgramFiles%\mozilla firefox\mozavutil.dll.aos
%ProgramFiles%\mozilla firefox\mozglue.dll.aos
%ProgramFiles%\mozilla firefox\mozwer.dll.aos
%ProgramFiles%\mozilla firefox\msvcp140.dll.aos
%ProgramFiles%\mozilla firefox\nss3.dll.aos
%ProgramFiles%\mozilla firefox\nssckbi.dll.aos
%ProgramFiles%\mozilla firefox\omni.ja.aos
%ProgramFiles%\mozilla firefox\osclientcerts.dll.aos
%ProgramFiles%\mozilla firefox\pingsender.exe.aos
%ProgramFiles%\mozilla firefox\platform.ini.aos
%ProgramFiles%\mozilla firefox\plugin-container.exe.aos
%ProgramFiles%\mozilla firefox\plugin-container.exe.sig.aos
%ProgramFiles%\mozilla firefox\freebl3.dll.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\trusted.libraries.aos
%ProgramFiles%\mozilla firefox\dependentlibs.list.aos
%ProgramFiles%\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-conio-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-private-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-process-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll.aos
%ProgramFiles%\mozilla firefox\application.ini.aos
%ProgramFiles%\mozilla firefox\crashreporter.exe.aos
%ProgramFiles%\mozilla firefox\crashreporter.ini.aos
%ProgramFiles%\mozilla firefox\d3dcompiler_47.dll.aos
%ProgramFiles%\mozilla firefox\default-browser-agent.exe.aos
%ProgramFiles%\mozilla firefox\defaultagent.ini.aos
%ProgramFiles%\mozilla firefox\defaultagent_localized.ini.aos
%ProgramFiles%\mozilla firefox\firefox.exe.aos
%ProgramFiles%\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\java.security.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts.aos
%ProgramFiles%\mozilla firefox\qipcap64.dll.aos
%ProgramFiles%\java\jre1.8.0_77\lib\jce.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt.aos
%ProgramFiles%\java\jre1.8.0_77\lib\logging.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\meta-index.aos
%ProgramFiles%\java\jre1.8.0_77\lib\net.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja.aos
%ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\resources.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\rt.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\sound.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\tzmappings.aos
%ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg.aos
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src.aos
%ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf.aos
%ProgramFiles%\mozilla firefox\precomplete.aos
%ProgramFiles%\java\jre1.8.0_77\bin\unpack.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\unpack200.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\verify.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\w2k_lsa_auth.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\windowsaccessbridge-64.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\wsdetect.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\zip.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\dtplugin\deployjava1.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\dtplugin\npdeployjava1.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\plugin2\msvcr100.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\plugin2\npjp2.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa.aos
%ProgramFiles%\java\jre1.8.0_77\bin\server\jvm.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt.aos
%ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\classlist.aos
%ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\currency.data.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc.aos
%ProgramFiles%\java\jre1.8.0_77\bin\t2k.dll.aos
%ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties.aos
%ProgramFiles%\mozilla firefox\firefox.exe.sig.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc.aos
%ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc.aos
%ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access.aos
%ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template.aos
%ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist.aos
%ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar.aos
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties.aos
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar.aos
%CommonProgramFiles%\system\ado\msador15.dll.aos
%ProgramFiles%\mozilla firefox\removed-files.aos
%ProgramFiles%\windows defender.bak\mpasdesc.dll.aos
%ProgramFiles%\windows defender.bak\mpazsubmit.dll.aos
%ProgramFiles%\windows defender.bak\mpclient.dll.aos
%ProgramFiles%\windows defender.bak\mpcmdrun.exe.aos
%ProgramFiles%\windows defender.bak\mpcommu.dll.aos
%ProgramFiles%\windows defender.bak\mpevmsg.dll.aos
%ProgramFiles%\windows defender.bak\mpoav.dll.aos
%ProgramFiles%\windows defender.bak\mpprovider.dll.aos
%ProgramFiles%\windows defender.bak\mprtp.dll.aos
%ProgramFiles%\windows defender.bak\mpsvc.dll.aos
%ProgramFiles%\windows defender.bak\msmpcom.dll.aos
%ProgramFiles%\windows defender.bak\msmpeng.exe.aos
%ProgramFiles%\windows defender.bak\msmplics.dll.aos
%ProgramFiles%\windows defender.bak\msmpres.dll.aos
%ProgramFiles%\windows defender.bak\nissrv.exe.aos
%ProgramFiles%\windows defender.bak\protectionmanagement.dll.aos
%ProgramFiles%\windows defender.bak\protectionmanagement.mof.aos
%ProgramFiles%\windows defender.bak\protectionmanagement_uninstall.mof.aos
%ProgramFiles%\windows defender.bak\shellext.dll.aos
%ProgramFiles%\windows defender.bak\thirdpartynotices.txt.aos
%ProgramFiles%\windows defender.bak\en-us\eppmanifest.dll.mui.aos
%ProgramFiles%\windows defender.bak\en-us\mpasdesc.dll.mui.aos
%ProgramFiles%\windows defender.bak\en-us\mpevmsg.dll.mui.aos
%ProgramFiles%\windows defender.bak\fepunregister.mof.aos
%ProgramFiles%\windows defender.bak\en-us\msmpres.dll.mui.aos
%ProgramFiles%\windows defender.bak\eppmanifest.dll.aos
%ProgramFiles%\windows defender.bak\configsecuritypolicy.exe.aos
%ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf.aos
%ProgramFiles%\mozilla thunderbird\isp\bogofilter.sfd.aos
%ProgramFiles%\mozilla thunderbird\isp\dspam.sfd.aos
%ProgramFiles%\mozilla thunderbird\isp\popfile.sfd.aos
%ProgramFiles%\mozilla thunderbird\isp\spamassassin.sfd.aos
%ProgramFiles%\mozilla thunderbird\isp\spampal.sfd.aos
%ProgramFiles%\mozilla thunderbird\uninstall\helper.exe.aos
%ProgramFiles%\mozilla thunderbird\uninstall\shortcuts_log.ini.aos
%ProgramFiles%\mozilla thunderbird\uninstall\uninstall.log.aos
%ProgramFiles%\windows defender advanced threat protection\mssense.exe.aos
%ProgramFiles%\windows defender advanced threat protection\sensecncproxy.exe.aos
%ProgramFiles%\windows defender advanced threat protection\sensecncps.dll.aos
%ProgramFiles%\windows defender advanced threat protection\senseir.exe.aos
%ProgramFiles%\windows defender advanced threat protection\sensemirror.dll.aos
%ProgramFiles%\windows defender advanced threat protection\sensesampleuploader.exe.aos
%ProgramFiles%\windows defender advanced threat protection\watpcsp.dll.aos
%ProgramFiles%\windows defender advanced threat protection\classification\mce.dll.aos
%ProgramFiles%\windows defender advanced threat protection\classification\sensece.exe.aos
%ProgramFiles%\windows defender advanced threat protection\en-us\mssense.exe.mui.aos
%ProgramFiles%\windows defender.bak\ammonitoringinstall.mof.aos
%ProgramFiles%\windows defender.bak\ammonitoringprovider.dll.aos
%ProgramFiles%\windows defender.bak\amstatusinstall.mof.aos
%ProgramFiles%\windows defender.bak\clientwmiinstall.mof.aos
%ProgramFiles%\windows defender.bak\defendercsp.dll.aos
%ProgramFiles%\mozilla thunderbird\features\wetransfer@extensions.thunderbird.net.xpi.aos
%ProgramFiles%\java\jre1.8.0_77\bin\sunmscapi.dll.aos
%ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js.aos
%ProgramFiles%\windows media player\en-us\wmpnssci.dll.mui.aos
%ProgramFiles%\windows media player\en-us\wmpnssui.dll.mui.aos
%ProgramFiles%\windows media player\skins\revert.wmz.aos
%ProgramFiles%\windows multimedia platform\sqmapi.dll.aos
%ProgramFiles%\windows nt\accessories\wordpad.exe.aos
%ProgramFiles%\windows nt\accessories\wordpadfilter.dll.aos
%ProgramFiles%\windows nt\accessories\en-us\wordpad.exe.mui.aos
%ProgramFiles%\windows nt\tabletextservice\tabletextservice.dll.aos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicearray.txt.aos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicedayi.txt.aos
%ProgramFiles%\windows nt\tabletextservice\tabletextservicetigrinya.txt.aos
%ProgramFiles%\windows nt\tabletextservice\tabletextserviceyi.txt.aos
%ProgramFiles%\windows nt\tabletextservice\en-us\tabletextservice.dll.mui.aos
%ProgramFiles%\windows photo viewer\imagingdevices.exe.aos
%ProgramFiles%\windows photo viewer\imagingengine.dll.aos
%ProgramFiles%\windows photo viewer\photoacq.dll.aos
%ProgramFiles%\windows photo viewer\photobase.dll.aos
%ProgramFiles%\windows photo viewer\photoviewer.dll.aos
%ProgramFiles%\windows photo viewer\en-us\imagingdevices.exe.mui.aos
%ProgramFiles%\windows photo viewer\en-us\photoacq.dll.mui.aos
%ProgramFiles%\windows photo viewer\en-us\photoviewer.dll.mui.aos
%ProgramFiles%\windows portable devices\sqmapi.dll.aos
%ProgramFiles%\windows security\browsercore\browsercore.exe.aos
%ProgramFiles%\windows media player\en-us\wmpnscfg.exe.mui.aos
%ProgramFiles%\windows defender.bak\en-us\protectionmanagement.dll.mui.aos
%ProgramFiles%\windows defender.bak\en-us\offlinescannershell.exe.mui.aos
%ProgramFiles%\windows media player\en-us\wmplayer.exe.mui.aos
%ProgramFiles%\windows defender.bak\en-us\protectionmanagement_uninstall.mfl.aos
%ProgramFiles%\windows defender.bak\en-us\shellext.dll.mui.aos
%ProgramFiles%\windows defender.bak\offline\eppmanifest.dll.aos
%ProgramFiles%\windows defender.bak\offline\msmplics.dll.aos
%ProgramFiles%\windows defender.bak\offline\offlinescannershell.exe.aos
%ProgramFiles%\windows mail\wab.exe.aos
%ProgramFiles%\windows mail\wabimp.dll.aos
%ProgramFiles%\windows mail\wabmig.exe.aos
%ProgramFiles%\windows media player\mpvis.dll.aos
%ProgramFiles%\windows media player\setup_wm.exe.aos
%ProgramFiles%\windows media player\wmlaunch.exe.aos
%ProgramFiles%\windows media player\wmpconfig.exe.aos
%ProgramFiles%\windows media player\wmplayer.exe.aos
%ProgramFiles%\windows media player\wmpmediasharing.dll.aos
%ProgramFiles%\windows media player\wmpnetwk.exe.aos
%ProgramFiles%\windows media player\wmpnscfg.exe.aos
%ProgramFiles%\windows media player\wmpnssci.dll.aos
%ProgramFiles%\windows media player\wmpnssui.dll.aos
%ProgramFiles%\windows media player\wmprph.exe.aos
%ProgramFiles%\windows media player\wmpshare.exe.aos
%ProgramFiles%\windows media player\en-us\mpvis.dll.mui.aos
%ProgramFiles%\windows media player\en-us\setup_wm.exe.mui.aos
%ProgramFiles%\windows media player\en-us\wmlaunch.exe.mui.aos
%ProgramFiles%\windows media player\en-us\wmpmediasharing.dll.mui.aos
%ProgramFiles%\windows defender.bak\en-us\protectionmanagement.mfl.aos
%ProgramFiles%\java\jre1.8.0_77\bin\tnameserv.exe.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\messengerwindow.ico.aos
%ProgramFiles%\mozilla thunderbird\pingsender.exe.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l1-2-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l2-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-core-localization-l1-2-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-core-processthreads-l1-1-1.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-core-synch-l1-2-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-core-timezone-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-conio-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-convert-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-environment-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-filesystem-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-heap-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-locale-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-math-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-multibyte-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-private-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-process-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-runtime-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-stdio-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-string-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-time-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\api-ms-win-crt-utility-l1-1-0.dll.aos
%ProgramFiles%\mozilla thunderbird\application.ini.aos
%ProgramFiles%\mozilla thunderbird\accessiblehandler.dll.aos
%ProgramFiles%\mozilla thunderbird\crashreporter.exe.aos
%ProgramFiles%\mozilla thunderbird\accessible.tlb.aos
%ProgramFiles%\mozilla firefox\uninstall\shortcuts_log.ini.aos
%ProgramFiles%\mozilla firefox\ucrtbase.dll.aos
%ProgramFiles%\mozilla firefox\update-settings.ini.aos
%ProgramFiles%\mozilla firefox\updater.exe.aos
%ProgramFiles%\mozilla firefox\updater.ini.aos
%ProgramFiles%\mozilla firefox\vcruntime140.dll.aos
%ProgramFiles%\mozilla firefox\xul.dll.aos
%ProgramFiles%\mozilla firefox\xul.dll.sig.aos
%ProgramFiles%\mozilla firefox\browser\crashreporter-override.ini.aos
%ProgramFiles%\mozilla firefox\browser\omni.ja.aos
%ProgramFiles%\mozilla firefox\browser\override.ini.aos
%ProgramFiles%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi.aos
%ProgramFiles%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi.aos
%ProgramFiles%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi.aos
%ProgramFiles%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi.aos
%ProgramFiles%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi.aos
%ProgramFiles%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi.aos
%ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js.aos
%ProgramFiles%\mozilla firefox\distibution\policies.json.aos
%ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf.aos
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.aos
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig.aos
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json.aos
%ProgramFiles%\mozilla firefox\uninstall\helper.exe.aos
%ProgramFiles%\mozilla firefox\uninstall\uninstall.log.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\msgcomposewindow.ico.aos
%ProgramFiles%\mozilla firefox\softokn3.dll.aos
%ProgramFiles%\mozilla thunderbird\accessiblemarshal.dll.aos
%ProgramFiles%\mozilla thunderbird\plugin-container.exe.aos
%ProgramFiles%\mozilla thunderbird\plugin-hang-ui.exe.aos
%ProgramFiles%\mozilla thunderbird\precomplete.aos
%ProgramFiles%\mozilla thunderbird\prldap60.dll.aos
%ProgramFiles%\mozilla thunderbird\qipcap64.dll.aos
%ProgramFiles%\mozilla thunderbird\removed-files.aos
%ProgramFiles%\mozilla thunderbird\rnp.dll.aos
%ProgramFiles%\mozilla thunderbird\softokn3.dll.aos
%ProgramFiles%\mozilla thunderbird\thunderbird.exe.aos
%ProgramFiles%\mozilla thunderbird\ucrtbase.dll.aos
%ProgramFiles%\mozilla thunderbird\update-settings.ini.aos
%ProgramFiles%\mozilla thunderbird\updater.exe.aos
%ProgramFiles%\mozilla thunderbird\updater.ini.aos
%ProgramFiles%\mozilla thunderbird\vcruntime140.dll.aos
%ProgramFiles%\mozilla thunderbird\wsenable.exe.aos
%ProgramFiles%\mozilla thunderbird\xul.dll.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\addressbookwindow.ico.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-alarm-dialog.ico.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-dialog.ico.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-summary-dialog.ico.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-dialog.ico.aos
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-summary-dialog.ico.aos
%ProgramFiles%\mozilla thunderbird\platform.ini.aos
%ProgramFiles%\mozilla thunderbird\d3dcompiler_47.dll.aos
%ProgramFiles%\mozilla thunderbird\crashreporter.ini.aos
%ProgramFiles%\mozilla thunderbird\omni.ja.aos
%ProgramFiles%\mozilla thunderbird\freebl3.dll.aos
%ProgramFiles%\mozilla thunderbird\ia2marshal.dll.aos
%ProgramFiles%\mozilla thunderbird\install.log.aos
%ProgramFiles%\mozilla thunderbird\ldap60.dll.aos
%ProgramFiles%\mozilla thunderbird\ldif60.dll.aos
%ProgramFiles%\mozilla thunderbird\lgpllibs.dll.aos
%ProgramFiles%\mozilla thunderbird\libegl.dll.aos
%ProgramFiles%\mozilla thunderbird\libgcrypt-20.dll.aos
%ProgramFiles%\mozilla thunderbird\libglesv2.dll.aos
%ProgramFiles%\mozilla thunderbird\libgpg-error6-0.dll.aos
%ProgramFiles%\mozilla thunderbird\libotr-5.dll.aos
%ProgramFiles%\mozilla thunderbird\libssp-0.dll.aos
%ProgramFiles%\mozilla thunderbird\maintenanceservice.exe.aos
%ProgramFiles%\mozilla thunderbird\maintenanceservice_installer.exe.aos
%ProgramFiles%\mozilla thunderbird\mapiproxy.dll.aos
%ProgramFiles%\mozilla thunderbird\mapiproxy_inuse.dll.aos
%ProgramFiles%\mozilla thunderbird\minidump-analyzer.exe.aos
%ProgramFiles%\mozilla thunderbird\mozglue.dll.aos
%ProgramFiles%\mozilla thunderbird\mozmapi32.dll.aos
%ProgramFiles%\mozilla thunderbird\mozmapi32_inuse.dll.aos
%ProgramFiles%\mozilla thunderbird\msvcp140.dll.aos
%ProgramFiles%\mozilla thunderbird\nss3.dll.aos
%ProgramFiles%\mozilla thunderbird\nssckbi.dll.aos
%ProgramFiles%\mozilla thunderbird\osclientcerts.dll.aos
%ProgramFiles%\mozilla thunderbird\dependentlibs.list.aos
%ProgramFiles%\java\jre1.8.0_77\bin\sunec.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\ssvagent.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\ssv.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ipskor.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsmigrationplugin.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ipsnld.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsnor.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsplk.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsplugin.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ipsptb.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsptg.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsrom.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsrus.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipssrb.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipssrl.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipssve.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipstr.xml.aos
%CommonProgramFiles%\microsoft shared\ink\micaut.dll.aos
%CommonProgramFiles%\microsoft shared\ink\microsoft.ink.dll.aos
%CommonProgramFiles%\microsoft shared\ink\mip.exe.aos
%CommonProgramFiles%\microsoft shared\ink\mraut.dll.aos
%CommonProgramFiles%\microsoft shared\ink\mshwgst.dll.aos
%CommonProgramFiles%\microsoft shared\ink\mshwlatin.dll.aos
%CommonProgramFiles%\microsoft shared\ink\rtscom.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ipsid.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipshrv.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsjpn.xml.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.aos
%CommonProgramFiles%\microsoft shared\ink\shapecollector.exe.aos
%CommonProgramFiles%\microsoft shared\filters\offfiltx.dll.aos
%CommonProgramFiles%\microsoft shared\ink\content.xml.aos
%CommonProgramFiles%\microsoft shared\ink\hwrcommonlm.dat.aos
%CommonProgramFiles%\microsoft shared\ink\hwrenclm.dat.aos
%CommonProgramFiles%\microsoft shared\ink\hwrlatinlm.dat.aos
%CommonProgramFiles%\microsoft shared\ink\hwrusalm.dat.aos
%CommonProgramFiles%\microsoft shared\ink\hwrusash.dat.aos
%CommonProgramFiles%\microsoft shared\ink\inkdiv.dll.aos
%CommonProgramFiles%\microsoft shared\ink\inkobj.dll.aos
%CommonProgramFiles%\microsoft shared\ink\inputpersonalization.exe.aos
%CommonProgramFiles%\microsoft shared\ink\ipsar.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipscat.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipschs.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipscht.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipscsy.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsdan.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsdeu.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsel.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsen.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsesp.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsfin.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipsfra.xml.aos
%CommonProgramFiles%\microsoft shared\ink\ipshi.xml.aos
%CommonProgramFiles%\microsoft shared\filters\visfilt.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ipshe.xml.aos
%CommonProgramFiles%\microsoft shared\ink\alphabet.xml.aos
%CommonProgramFiles%\microsoft shared\ink\tabipsps.dll.aos
%CommonProgramFiles%\microsoft shared\ink\tipres.dll.aos
%CommonProgramFiles%\microsoft shared\ink\fr-ca\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\fr-fr\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\insert.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskclearui.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknav.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\ea.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\base.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\basealtgr_rtl.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\base_ca.xml.aos
%CommonProgramFiles%\microsoft shared\ink\es-mx\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\es-es\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\fi-fi\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\et-ee\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\tabskb.dll.aos
%CommonProgramFiles%\microsoft shared\ink\tabtip.exe.aos
%CommonProgramFiles%\microsoft shared\ink\tipresx.dll.aos
%CommonProgramFiles%\microsoft shared\ink\tipskins.dll.aos
%CommonProgramFiles%\microsoft shared\ink\tiptsf.dll.aos
%CommonProgramFiles%\microsoft shared\ink\tpcps.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ar-sa\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\bg-bg\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\cs-cz\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\da-dk\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\de-de\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\el-gr\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-gb\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\inkobj.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\inputpersonalization.exe.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\micaut.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\mip.exe.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\mshwlatin.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\rtscom.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\shapecollector.exe.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\tabskb.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\tabtip.exe.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\tipres.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\tiptsf.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\thirdpartynotices.mshwlatin.txt.aos
%CommonProgramFiles%\microsoft shared\ink\en-us\tipresx.dll.mui.aos
%ProgramFiles%\windows security\browsercore\manifest.json.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\base_heb.xml.aos
%ProgramFiles%\desktop.ini.aos
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.aos
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.msi.aos
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.aos
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.aos
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.aos
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.msi.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.cab.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.aos
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.aos
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\inflr.cab.aos
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.aos
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml.aos
%CommonProgramFiles%\microsoft shared\filters\msgfilt.dll.aos
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.msi.aos
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab.aos
C:\kms\kms_vl_all_aio.cmd.aos
C:\kms\kms_vl_all_aio_debug.log.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\ose.exe.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\osetup.dll.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pidgenx.dll.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi.aos
C:\$recycle.bin\s-1-5-21-2377844457-1847597103-2569463324-1000\desktop.ini.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.dll.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.exe.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.aos
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.aos
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.aos
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.aos
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.aos
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.aos
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.aos
%CommonProgramFiles%\microsoft shared\filters\odffilt.dll.aos
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.aos
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.msi.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.chm.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\shellui.mst.aos
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.msi.aos
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.xml.aos
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.msi.aos
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.xml.aos
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\owow64lr.cab.aos
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.msi.aos
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.aos
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.msi.aos
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.aos
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\acclr.cab.aos
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.aos
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.cab.aos
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.msi.aos
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.xml.aos
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\setup.xml.aos
<Current directory>\image.jpg.aos
<Full path to file>.aos
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm.aos
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.cab.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\osetupui.dll.aos
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publr.cab.aos
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml.aos
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.msi.aos
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.aos
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab.aos
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovelr.cab.aos
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.msi.aos
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.aos
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.cab.aos
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.msi.aos
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.xml.aos
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.cab.aos
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.msi.aos
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.xml.aos
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\setup.xml.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\branding.xml.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officelr.cab.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.msi.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.msi.aos
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\offsetlr.cab.aos
%ProgramFiles%\windows media player\en-us\wmpnetwk.exe.mui.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.aos
%ProgramFiles%\java\jre1.8.0_77\readme.txt.aos
%ProgramFiles%\java\jre1.8.0_77\release.aos
%ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt.aos
%ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt.aos
%ProgramFiles%\java\jre1.8.0_77\bin\awt.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\bci.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\dcpr.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\decora_sse.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\deploy.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\dt_shmem.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\dt_socket.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\eula.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\fontmanager.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\fxplugins.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\glass.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\glib-lite.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\gstreamer-lite.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\hprof.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\instrument.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\j2pcsc.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\j2pkcs11.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jaas_nt.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jabswitch.exe.aos
%ProgramFiles%\java\jre1.8.0_77\license.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\base_kor.xml.aos
%ProgramFiles%\java\jre1.8.0_77\copyright.aos
%ProgramFiles%\internet explorer\images\bing.ico.aos
%CommonProgramFiles%\system\ole db\oledb32.dll.aos
%CommonProgramFiles%\system\ole db\oledb32r.dll.aos
%CommonProgramFiles%\system\ole db\oledbjvs.inc.aos
%CommonProgramFiles%\system\ole db\oledbvbs.inc.aos
%CommonProgramFiles%\system\ole db\sqloledb.dll.aos
%CommonProgramFiles%\system\ole db\sqloledb.rll.aos
%CommonProgramFiles%\system\ole db\sqlxmlx.dll.aos
%CommonProgramFiles%\system\ole db\sqlxmlx.rll.aos
%CommonProgramFiles%\system\ole db\en-us\msdasqlr.dll.mui.aos
%CommonProgramFiles%\system\ole db\en-us\oledb32r.dll.mui.aos
%CommonProgramFiles%\system\ole db\en-us\sqloledb.rll.mui.aos
%CommonProgramFiles%\system\ole db\en-us\sqlxmlx.rll.mui.aos
%ProgramFiles%\internet explorer\extexport.exe.aos
%ProgramFiles%\internet explorer\hmmapi.dll.aos
%ProgramFiles%\internet explorer\iediagcmd.exe.aos
%ProgramFiles%\internet explorer\ieinstal.exe.aos
%ProgramFiles%\internet explorer\ielowutil.exe.aos
%ProgramFiles%\internet explorer\ieshims.dll.aos
%ProgramFiles%\internet explorer\iexplore.exe.aos
%ProgramFiles%\internet explorer\sqmapi.dll.aos
%ProgramFiles%\internet explorer\en-us\hmmapi.dll.mui.aos
%ProgramFiles%\internet explorer\en-us\ieinstal.exe.mui.aos
%ProgramFiles%\internet explorer\en-us\iexplore.exe.mui.aos
%ProgramFiles%\internet explorer\signup\install.ins.aos
%CommonProgramFiles%\system\ole db\msxactps.dll.aos
%CommonProgramFiles%\system\ole db\msdatl3.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javaaccessbridge-64.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\klist.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\ktab.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\lcms.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\management.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\mlib_image.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\msvcp120.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\msvcr100.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\msvcr120.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\net.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\nio.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\npt.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\orbd.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\pack200.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\policytool.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\prism_common.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\prism_d3d.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\prism_sw.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\resource.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\rmid.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\rmiregistry.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\servertool.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\splashscreen.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\java.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\kinit.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\java.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\keytool.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\java-rmi.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javacpl.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javafx_font.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javafx_font_t2k.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javafx_iio.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javaw.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\javaws.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\java_crw_demo.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jawt.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jawtaccessbridge-64.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jdwp.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jfr.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jfxmedia.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jfxwebkit.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jjs.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jli.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jp2iexp.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jp2launcher.exe.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jp2native.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jp2ssv.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jpeg.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jsdt.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jsound.dll.aos
%ProgramFiles%\java\jre1.8.0_77\bin\kcms.dll.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.aos
%ProgramFiles%\java\jre1.8.0_77\bin\jsoundds.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ipsita.xml.aos
%CommonProgramFiles%\microsoft shared\ink\sk-sk\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\sl-si\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\sr-latn-rs\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\sv-se\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\th-th\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\tr-tr\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\uk-ua\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\zh-cn\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\zh-tw\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\msinfo\msinfo32.exe.aos
%CommonProgramFiles%\microsoft shared\msinfo\en-us\msinfo32.exe.mui.aos
%CommonProgramFiles%\microsoft shared\office16\cmigrate.exe.aos
%CommonProgramFiles%\microsoft shared\office16\csi.dll.aos
%CommonProgramFiles%\microsoft shared\office16\mso20win32client.dll.aos
%CommonProgramFiles%\microsoft shared\office16\mso30win32client.dll.aos
%CommonProgramFiles%\microsoft shared\office16\mso40uiwin32client.dll.aos
%CommonProgramFiles%\microsoft shared\office16\mso99lwin32client.dll.aos
%CommonProgramFiles%\microsoft shared\office16\msoshext.dll.aos
%CommonProgramFiles%\microsoft shared\office16\msoxev.dll.aos
%CommonProgramFiles%\microsoft shared\office16\msoxmled.exe.aos
%CommonProgramFiles%\microsoft shared\office16\msoxmlmf.dll.aos
%CommonProgramFiles%\microsoft shared\office16\oregres.dll.aos
%CommonProgramFiles%\microsoft shared\office16\cultures\office.odf.aos
%CommonProgramFiles%\microsoft shared\ink\ru-ru\tipresx.dll.mui.aos
%CommonProgramFiles%\system\ole db\msdaps.dll.aos
%CommonProgramFiles%\microsoft shared\ink\ro-ro\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\pt-br\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.aos
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.aos
%CommonProgramFiles%\microsoft shared\ink\he-il\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\hr-hr\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\hu-hu\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\it-it\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\ja-jp\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\ko-kr\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\lt-lt\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\lv-lv\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\nb-no\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\nl-nl\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\pl-pl\tipresx.dll.mui.aos
%CommonProgramFiles%\microsoft shared\ink\pt-pt\tipresx.dll.mui.aos
%CommonProgramFiles%\system\ole db\msdasqlr.dll.aos
%CommonProgramFiles%\system\ole db\msdasql.dll.aos
%CommonProgramFiles%\microsoft shared\vsto\vstoee.dll.aos
%CommonProgramFiles%\system\ado\msadrh15.dll.aos
%CommonProgramFiles%\system\ado\en-us\msader15.dll.mui.aos
%CommonProgramFiles%\system\en-us\wab32res.dll.mui.aos
%CommonProgramFiles%\system\msadc\adcjavas.inc.aos
%CommonProgramFiles%\system\msadc\adcvbs.inc.aos
%CommonProgramFiles%\system\msadc\msadce.dll.aos
%CommonProgramFiles%\system\msadc\msadcer.dll.aos
%CommonProgramFiles%\system\msadc\msadco.dll.aos
%CommonProgramFiles%\system\msadc\msadcor.dll.aos
%CommonProgramFiles%\system\msadc\msadds.dll.aos
%CommonProgramFiles%\system\msadc\msaddsr.dll.aos
%CommonProgramFiles%\system\msadc\msdaprsr.dll.aos
%CommonProgramFiles%\system\msadc\msdaprst.dll.aos
%CommonProgramFiles%\system\msadc\msdarem.dll.aos
%CommonProgramFiles%\system\msadc\msdaremr.dll.aos
%CommonProgramFiles%\system\msadc\msdfmap.dll.aos
%CommonProgramFiles%\system\msadc\en-us\msadcer.dll.mui.aos
%CommonProgramFiles%\system\msadc\en-us\msadcor.dll.mui.aos
%CommonProgramFiles%\system\msadc\en-us\msaddsr.dll.mui.aos
%CommonProgramFiles%\system\msadc\en-us\msdaprsr.dll.mui.aos
%CommonProgramFiles%\system\msadc\en-us\msdaremr.dll.mui.aos
%CommonProgramFiles%\system\ole db\msdaosp.dll.aos
%CommonProgramFiles%\microsoft shared\vc\msdia100.dll.aos
%CommonProgramFiles%\system\ado\msadox28.tlb.aos
%CommonProgramFiles%\microsoft shared\vgx\vgx.dll.aos
%CommonProgramFiles%\system\ado\msadox.dll.aos
%CommonProgramFiles%\microsoft shared\office16\en-us\oregres.dll.mui.aos
%CommonProgramFiles%\microsoft shared\vsto\vstoee100.tlb.aos
%CommonProgramFiles%\microsoft shared\vsto\vstoee90.tlb.aos
%CommonProgramFiles%\microsoft shared\vsto\10.0\vstoinstaller.exe.aos
%CommonProgramFiles%\microsoft shared\vsto\10.0\vstoloader.dll.aos
%CommonProgramFiles%\microsoft shared\vsto\10.0\vstomessageprovider.dll.aos
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\vstoinstallerui.dll.aos
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\vstoloaderui.dll.aos
%CommonProgramFiles%\services\verisign.bmp.aos
%CommonProgramFiles%\system\wab32.dll.aos
%CommonProgramFiles%\system\wab32res.dll.aos
%CommonProgramFiles%\system\ado\adojavas.inc.aos
%CommonProgramFiles%\system\ado\adovbs.inc.aos
%CommonProgramFiles%\system\ado\msader15.dll.aos
%CommonProgramFiles%\system\ado\msado15.dll.aos
%CommonProgramFiles%\system\ado\msado20.tlb.aos
%CommonProgramFiles%\system\ado\msado21.tlb.aos
%CommonProgramFiles%\system\ado\msado25.tlb.aos
%CommonProgramFiles%\system\ado\msado26.tlb.aos
%CommonProgramFiles%\system\ado\msado27.tlb.aos
%CommonProgramFiles%\system\ado\msado28.tlb.aos
%CommonProgramFiles%\system\ado\msado60.tlb.aos
%CommonProgramFiles%\system\ado\msadomd.dll.aos
%CommonProgramFiles%\system\ado\msadomd28.tlb.aos
%CommonProgramFiles%\system\ado\msador28.tlb.aos
%ProgramFiles%\windows security\browsercore\en-us\browsercore.exe.mui.aos

Modifies the following files

%APPDATA%\microsoft\windows\themes\transcodedwallpaper
%APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'i.##gur.com':443

TCP

Other

'i.##gur.com':443

UDP

DNS ASK i.##gur.com

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial