Trojan.Encoder.41507

Technical Information

Modifies file system

Creates the following files

<Current directory>\dbglog.sys
%CommonProgramFiles%\microsoft shared\themes14\papyrus\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\pixel\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\profile\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\quad\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\radial\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\refined\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\ripple\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\journal\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\sky\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\slate\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\sonora\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\spring\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\strtedge\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\studio\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\water\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\level\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\network\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\layers\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\iris\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\blends\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\boldstri\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\breeze\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\canyon\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\capsules\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\watermar\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\arctic\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\satin\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\cascade\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\echo\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\eclipse\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\edge\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\expeditn\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\ice\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\indust\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\compass\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\concrete\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\deepblue\readme.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\readme.txt
%CommonProgramFiles%\microsoft shared\translat\arfr\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\push\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\readme.txt
%ProgramFiles%\dvd maker\shared\readme.txt
%ProgramFiles%\dvd maker\readme.txt
%ProgramFiles%\internet explorer\en-us\readme.txt
%ProgramFiles%\internet explorer\signup\readme.txt
%ProgramFiles%\internet explorer\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\readme.txt
%CommonProgramFiles%\microsoft shared\themes14\axis\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\readme.txt
%CommonProgramFiles%\system\ado\readme.txt
%CommonProgramFiles%\microsoft shared\translat\esen\readme.txt
%CommonProgramFiles%\microsoft shared\translat\frar\readme.txt
%CommonProgramFiles%\microsoft shared\translat\fren\readme.txt
%CommonProgramFiles%\microsoft shared\translat\readme.txt
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\readme.txt
%CommonProgramFiles%\microsoft shared\vsto\10.0\readme.txt
%CommonProgramFiles%\microsoft shared\vsto\readme.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\full\readme.txt
%CommonProgramFiles%\microsoft shared\translat\enes\readme.txt
%CommonProgramFiles%\microsoft shared\translat\enfr\readme.txt
%CommonProgramFiles%\system\en-us\readme.txt
%CommonProgramFiles%\system\msadc\en-us\readme.txt
%CommonProgramFiles%\system\msadc\readme.txt
%CommonProgramFiles%\system\ole db\en-us\readme.txt
%CommonProgramFiles%\system\ole db\readme.txt
%ProgramFiles%\dvd maker\en-us\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\readme.txt
%CommonProgramFiles%\system\ado\en-us\readme.txt
%CommonProgramFiles%\services\readme.txt
%CommonProgramFiles%\microsoft shared\textconv\readme.txt
%CommonProgramFiles%\microsoft shared\stationery\readme.txt
%CommonProgramFiles%\microsoft shared\smart tag\readme.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\readme.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\readme.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\readme.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\readme.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\readme.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\readme.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\readme.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\readme.txt
%CommonProgramFiles%\microsoft shared\ink\it-it\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\readme.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\readme.txt
%ProgramFiles%\java\jre1.8.0_45\bin\server\readme.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\readme.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\readme.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\readme.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\readme.txt
%CommonProgramFiles%\microsoft shared\equation\readme.txt
%CommonProgramFiles%\microsoft shared\grphflt\readme.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\readme.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\readme.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\readme.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\readme.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\readme.txt
%CommonProgramFiles%\microsoft shared\office14\readme.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\readme.txt
%CommonProgramFiles%\microsoft shared\proof\readme.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\readme.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\readme.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\readme.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\readme.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\readme.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\readme.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\readme.txt
%CommonProgramFiles%\microsoft shared\ink\pt-pt\readme.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\readme.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\readme.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\readme.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\readme.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\readme.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\readme.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\readme.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\readme.txt
%CommonProgramFiles%\microsoft shared\ink\readme.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\readme.txt
%CommonProgramFiles%\microsoft shared\office14\1033\readme.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\readme.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\readme.txt
%CommonProgramFiles%\microsoft shared\ink\th-th\readme.txt
%ProgramFiles%\java\jre1.8.0_45\bin\readme.txt

Moves the following files

from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19988_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19988_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04225_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04225_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04235_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04235_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04267_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04267_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04269_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04385_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04385_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06102_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06102_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl to %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl.flocked
from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.flocked
from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.flocked
from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\classlist to %ProgramFiles%\java\jre1.8.0_45\lib\classlist.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf.flocked
from %ProgramFiles%\internet explorer\signup\install.ins to %ProgramFiles%\internet explorer\signup\install.ins.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\currency.data to %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklisted.certs to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklisted.certs.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\java.policy to %ProgramFiles%\java\jre1.8.0_45\lib\security\java.policy.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\java.security to %ProgramFiles%\java\jre1.8.0_45\lib\security\java.security.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\javaws.policy to %ProgramFiles%\java\jre1.8.0_45\lib\security\javaws.policy.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties to %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.flocked
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.flocked
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as90.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as90.xsl.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\informix.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\informix.xsl.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl.flocked
from %ProgramFiles%\java\jre1.8.0_45\readme.txt to %ProgramFiles%\java\jre1.8.0_45\readme.txt.flocked
from %ProgramFiles%\java\jre1.8.0_45\release to %ProgramFiles%\java\jre1.8.0_45\release.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties to %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar to %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties to %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\management-agent.jar to %ProgramFiles%\java\jre1.8.0_45\lib\management-agent.jar.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\net.properties to %ProgramFiles%\java\jre1.8.0_45\lib\net.properties.flocked
from %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar.flocked
from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll.flocked
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf.flocked

Modifies the following files

C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi.flocked
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi.flocked
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab.flocked
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.flocked
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.flocked
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.flocked
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi.flocked
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab.flocked
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.flocked
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab.flocked
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.flocked
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi.flocked
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.flocked
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab.flocked
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.flocked
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi.flocked
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.flocked
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.flocked
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi.flocked
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab.flocked
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.flocked
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.flocked
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.cab.flocked

Modifies multiple files.

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c net config Workstation
'%WINDIR%\syswow64\cmd.exe' /c schtasks /query /fo LIST /v
'%WINDIR%\syswow64\net1.exe' start
'%WINDIR%\syswow64\net.exe' start
'%WINDIR%\syswow64\cmd.exe' /c net start
'%WINDIR%\syswow64\tasklist.exe' /SVC
'%WINDIR%\syswow64\cmd.exe' /c tasklist /SVC
'%WINDIR%\syswow64\cmd.exe' /c netstat -ano
'%WINDIR%\syswow64\cmd.exe' /c arp -A
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall show config
'%WINDIR%\syswow64\netsh.exe' firewall show state
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall show state
'%WINDIR%\syswow64\netstat.exe' -ano
'%WINDIR%\syswow64\schtasks.exe' /query /fo LIST /v
'%WINDIR%\syswow64\cmd.exe' /c DRIVERQUERY
'%WINDIR%\syswow64\netsh.exe' firewall show config
'%WINDIR%\syswow64\route.exe' print
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\net1.exe' users
'%WINDIR%\syswow64\driverquery.exe'
'%WINDIR%\syswow64\cmd.exe' /c net users
'%WINDIR%\syswow64\cmd.exe' /c route print
'%WINDIR%\syswow64\net.exe' users
'%WINDIR%\syswow64\cmd.exe' /c systeminfo
'%WINDIR%\syswow64\net1.exe' config Workstation
'%WINDIR%\syswow64\net.exe' config Workstation
'%WINDIR%\syswow64\hostname.exe'
'%WINDIR%\syswow64\arp.exe' -A
'%WINDIR%\syswow64\cmd.exe' /c hostname
'%WINDIR%\syswow64\cmd.exe' /c DRIVERQUERY' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall show state' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net config Workstation' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c arp -A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c systeminfo' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netstat -ano' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c schtasks /query /fo LIST /v' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c hostname' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall show config' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net users' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c tasklist /SVC' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net start' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c route print' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial