Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XO1XADpO01' = '"<Full path to file>"'
Creates the following files on removable media
- <Drive name for removable media>:\restore-my-files.txt
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\waterresourcesag.pptx
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Injects code into
the following system processes:
- <SYSTEM32>\csrss.exe
the following user processes:
- firefox.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- z:\system volume information\wpsettings.dat
- %ProgramFiles%\mozilla firefox\webapprt\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\uninstall\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\dictionaries\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\defaults\pref\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\browser\features\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\browser\extensions\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\browser\components\restore-my-files.txt
- %ProgramFiles%\mozilla firefox\browser\restore-my-files.txt
- %ProgramFiles%\microsoft office\office16\onenote\restore-my-files.txt
- %ProgramFiles%\microsoft office\office16\restore-my-files.txt
- %ProgramFiles%\microsoft office\office16\1033\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\security\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\management\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\jfr\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\fonts\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\ext\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\deploy\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\cmm\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\amd64\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\restore-my-files.txt
- %ProgramFiles%\java\jre1.8.0_77\bin\server\restore-my-files.txt
- C:\krd2018_data\legal notices\restore-my-files.txt
- D:\restore-my-files.txt
- D:\install.log
- z:\$recycle.bin\s-1-5-21-1004681136-874170566-1875838749-1001\desktop.ini
- %ProgramFiles%\unp\logs\restore-my-files.txt
- %WINDIR%\logs\windowsbackup\wbengine.0.etl
Sets the 'hidden' attribute to the following files
- z:\$recycle.bin\s-1-5-21-1004681136-874170566-1875838749-1001\desktop.ini
Moves the following files
- from D:\install.log to D:\install.log.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.print3d_3.3.311.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.print3d_3.3.311.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.screensketch_10.1811.3471.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.screensketch_10.1811.3471.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.skypeapp_14.35.152.0_neutral_split.scale-125_kzf8qxf38zg5c\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.skypeapp_14.35.152.0_neutral_split.scale-125_kzf8qxf38zg5c\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.webmediaextensions_1.0.13321.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.webmediaextensions_1.0.13321.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windows.photos_2019.18114.19418.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windows.photos_2019.18114.19418.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsalarms_10.1812.10043.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsalarms_10.1812.10043.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowscalculator_10.1812.10048.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowscalculator_10.1812.10048.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsfeedbackhub_1.1811.10571.0_neutral_split.scale-140_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsfeedbackhub_1.1811.10571.0_neutral_split.scale-140_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsfeedbackhub_1.1811.10571.0_neutral_split.scale-180_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsfeedbackhub_1.1811.10571.0_neutral_split.scale-180_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowssoundrecorder_10.1812.10043.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowssoundrecorder_10.1812.10043.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowssoundrecorder_10.1812.10043.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowssoundrecorder_10.1812.10043.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsstore_11811.1001.18.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.windowsstore_11811.1001.18.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.xboxapp_48.48.7001.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.xboxapp_48.48.7001.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.xboxgamingoverlay_2.26.14003.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.xboxgamingoverlay_2.26.14003.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.yourphone_0.0.13313.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.yourphone_0.0.13313.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.zunemusic_10.18111.17311.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.zunemusic_10.18111.17311.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.zunevideo_10.18111.17311.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.zunevideo_10.18111.17311.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.people_10.1812.10232.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.people_10.1812.10232.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.print3d_3.3.311.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.print3d_3.3.311.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.xboxapp_48.48.7001.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.xboxapp_48.48.7001.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.microsoftstickynotes_3.1.53.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.microsoftstickynotes_3.1.53.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\mozilla firefox\freebl3.chk to %ProgramFiles%\mozilla firefox\freebl3.chk.lockbit
- from %ProgramFiles%\mozilla firefox\nssdbm3.chk to %ProgramFiles%\mozilla firefox\nssdbm3.chk.lockbit
- from %ProgramFiles%\mozilla firefox\omni.ja to %ProgramFiles%\mozilla firefox\omni.ja.lockbit
- from %ProgramFiles%\mozilla firefox\precomplete to %ProgramFiles%\mozilla firefox\precomplete.lockbit
- from %ProgramFiles%\mozilla firefox\removed-files to %ProgramFiles%\mozilla firefox\removed-files.lockbit
- from %ProgramFiles%\mozilla firefox\softokn3.chk to %ProgramFiles%\mozilla firefox\softokn3.chk.lockbit
- from %ProgramFiles%\mozilla firefox\uninstall\uninstall.log to %ProgramFiles%\mozilla firefox\uninstall\uninstall.log.lockbit
- from %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd to %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd.lockbit
- from %ProgramFiles%\mozilla firefox\browser\features\loop@mozilla.org.xpi to %ProgramFiles%\mozilla firefox\browser\features\loop@mozilla.org.xpi.lockbit
- from %ProgramFiles%\mozilla firefox\dictionaries\en-us.dic to %ProgramFiles%\mozilla firefox\dictionaries\en-us.dic.lockbit
- from %ProgramFiles%\mozilla firefox\install.log to %ProgramFiles%\mozilla firefox\install.log.lockbit
- from %ProgramFiles%\unp\logs\updatenotificationpipeline.002.etl to %ProgramFiles%\unp\logs\updatenotificationpipeline.002.etl.lockbit
- from %ProgramFiles%\mozilla firefox\webapprt\omni.ja to %ProgramFiles%\mozilla firefox\webapprt\omni.ja.lockbit
- from %ProgramFiles%\windowsapps\deleted\microsoft.microsoftsolitairecollection_4.2.11280.0_neutral_split.scale-125_8wekyb3d8bbwe76890228-275a-405e-8138-11a10895d3e2\appxsignature.p7x to %ProgramFiles%\windowsapps\deleted\microsoft.microsoftsolitairecollection_4.2.11280.0_neutral_split.scale-125_8wekyb3d8bbwe76890228-275a-405e-8138-11a10895d3e2\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deleted\microsoft.microsoftsolitairecollection_4.2.11280.0_neutral_split.scale-200_8wekyb3d8bbwe26063274-20e8-4489-9f72-c9f8af936f19\appxsignature.p7x to %ProgramFiles%\windowsapps\deleted\microsoft.microsoftsolitairecollection_4.2.11280.0_neutral_split.scale-200_8wekyb3d8bbwe26063274-20e8-4489-9f72-c9f8af936f19\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deleted\microsoft.windowscamera_2018.826.78.0_neutral_split.scale-125_8wekyb3d8bbwe8d98fc31-247b-4108-a27b-760a85cc3e9b\appxsignature.p7x to %ProgramFiles%\windowsapps\deleted\microsoft.windowscamera_2018.826.78.0_neutral_split.scale-125_8wekyb3d8bbwe8d98fc31-247b-4108-a27b-760a85cc3e9b\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deleted\microsoft.windowscamera_2018.826.78.0_neutral_split.scale-200_8wekyb3d8bbweb171e44b-f114-40d6-a5fb-79481aa7833c\appxsignature.p7x to %ProgramFiles%\windowsapps\deleted\microsoft.windowscamera_2018.826.78.0_neutral_split.scale-200_8wekyb3d8bbweb171e44b-f114-40d6-a5fb-79481aa7833c\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deleted\microsoft.windowsmaps_5.1812.10071.0_neutral_split.scale-125_8wekyb3d8bbwe67a1c948-7236-4390-9aa3-9af2001afee1\appxsignature.p7x to %ProgramFiles%\windowsapps\deleted\microsoft.windowsmaps_5.1812.10071.0_neutral_split.scale-125_8wekyb3d8bbwe67a1c948-7236-4390-9aa3-9af2001afee1\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.bingweather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.bingweather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.desktopappinstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.desktopappinstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.gethelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.gethelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.getstarted_7.3.20251.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.getstarted_7.3.20251.0_neutral_split.scale-200_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.microsoftofficehub_18.1901.1141.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.microsoftofficehub_18.1901.1141.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.mixedreality.portal_2000.19010.1151.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.mixedreality.portal_2000.19010.1151.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\mozilla firefox\browser\omni.ja to %ProgramFiles%\mozilla firefox\browser\omni.ja.lockbit
- from %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.oneconnect_5.1902.361.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\deletedalluserpackages\microsoft.oneconnect_5.1902.361.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.Microsoft3DViewer_5.1902.20012.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoft3dviewer_5.1902.20012.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoft3dviewer_5.1902.20012.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoft3dviewer_5.1902.20012.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1901.1141.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.fa2ad34b.pri to %ProgramFiles%\windowsapps\microsoft.microsoftofficehub_18.1901.1141.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.fa2ad34b.pri.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.2.11280.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftsolitairecollection_4.2.11280.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftsolitairecollection_4.2.11280.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.microsoftsolitairecollection_4.2.11280.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftsolitairecollection_4.2.11280.0_x86__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftsolitairecollection_4.2.11280.0_x86__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.MicrosoftStickyNotes_3.1.53.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.c09e5559.pri to %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.c09e5559.pri.lockbit
- from %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.MixedReality.Portal_2000.19010.1151.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.7ebad37e.pri to %ProgramFiles%\windowsapps\microsoft.mixedreality.portal_2000.19010.1151.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.7ebad37e.pri.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.MSPaint_2019.213.1858.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.mspaint_2019.213.1858.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.mspaint_5.1902.13017.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.mspaint_5.1902.13017.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.mspaint_5.1902.13017.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.mspaint_5.1902.13017.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.Office.OneNote_16001.11126.20076.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.office.onenote_16001.11126.20076.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.1ebd0f0e.pri to %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.1ebd0f0e.pri.lockbit
- from %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoft3dviewer_5.1902.20012.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.microsoft3dviewer_5.1902.20012.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_neutral_split.scale-150_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.messaging_4.1901.10241.0_neutral_split.scale-150_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.29e797f3.pri to %ProgramFiles%\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.29e797f3.pri.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi to %ProgramFiles%\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi.lockbit
- from %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\mozilla firefox\dictionaries\en-us.aff to %ProgramFiles%\mozilla firefox\dictionaries\en-us.aff.lockbit
- from %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.82520e7b.pri to %ProgramFiles%\windowsapps\microsoft.gethelp_10.1706.13331.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.82520e7b.pri.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.Getstarted_7.3.20251.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.getstarted_7.3.20251.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.getstarted_7.3.20251.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.getstarted_7.3.20251.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\windowsapps\microsoft.getstarted_7.3.20251.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.getstarted_7.3.20251.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.Messaging_2019.125.32.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.messaging_2019.125.32.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
- from %ProgramFiles%\WindowsApps\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x to %ProgramFiles%\windowsapps\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.3ce67b09.pri to %ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.3ce67b09.pri.lockbit
- from %ProgramFiles%\microsoft office\office16\visiocustom.propdesc to %ProgramFiles%\microsoft office\office16\visiocustom.propdesc.lockbit
- from %ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd to %ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd.lockbit
- from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar to %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\copyright to %ProgramFiles%\java\jre1.8.0_77\copyright.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\classlist to %ProgramFiles%\java\jre1.8.0_77\lib\classlist.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf.lockbit
- from %ProgramFiles%\windowsapps\microsoft.office.onenote_16001.11126.20076.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.office.onenote_16001.11126.20076.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\currency.data to %ProgramFiles%\java\jre1.8.0_77\lib\currency.data.lockbit
- from %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_x64__8wekyb3d8bbwe\appxsignature.p7x to %ProgramFiles%\windowsapps\microsoft.microsoftstickynotes_3.1.53.0_x64__8wekyb3d8bbwe\appxsignature.p7x.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf to %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\sound.properties to %ProgramFiles%\java\jre1.8.0_77\lib\sound.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\java.security to %ProgramFiles%\java\jre1.8.0_77\lib\security\java.security.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_77\lib\tzmappings.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\license to %ProgramFiles%\java\jre1.8.0_77\license.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\readme.txt to %ProgramFiles%\java\jre1.8.0_77\readme.txt.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\release to %ProgramFiles%\java\jre1.8.0_77\release.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif to %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif.lockbit
- from %ProgramFiles%\microsoft office\office16\custom.propdesc to %ProgramFiles%\microsoft office\office16\custom.propdesc.lockbit
- from %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt to %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt.lockbit
- from %ProgramFiles%\microsoft office\office16\mso example setup file a.txt to %ProgramFiles%\microsoft office\office16\mso example setup file a.txt.lockbit
- from %ProgramFiles%\microsoft office\office16\onenote\prnms006.inf to %ProgramFiles%\microsoft office\office16\onenote\prnms006.inf.lockbit
- from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat.lockbit
- from %ProgramFiles%\mozilla firefox\browser\chrome.manifest to %ProgramFiles%\mozilla firefox\browser\chrome.manifest.lockbit
- from %ProgramFiles%\mozilla firefox\browser\components\components.manifest to %ProgramFiles%\mozilla firefox\browser\components\components.manifest.lockbit
- from %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js to %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js.lockbit
- from %ProgramFiles%\mozilla firefox\dependentlibs.list to %ProgramFiles%\mozilla firefox\dependentlibs.list.lockbit
- from %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.info to %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.info.lockbit
- from %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat to %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy to %ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy.lockbit
- from %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt to %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar to %ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy to %ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\rt.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_77\lib\resources.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties to %ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_77\lib\logging.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template to %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template to %ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar to %ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jce.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties to %ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar to %ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\meta-index to %ProgramFiles%\java\jre1.8.0_77\lib\meta-index.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\net.properties to %ProgramFiles%\java\jre1.8.0_77\lib\net.properties.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs to %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar.lockbit
- from %ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar to %ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar.lockbit
- from %ProgramFiles%\windowsapps\microsoft.office.onenote_16001.11126.20076.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat to %ProgramFiles%\windowsapps\microsoft.office.onenote_16001.11126.20076.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat.lockbit
Substitutes the following files
- %ProgramFiles%\Java\jre1.8.0_77\lib\accessibility.properties
- %ProgramFiles%\Java\jre1.8.0_77\lib\images\cursors\cursors.properties
- %ProgramFiles%\Mozilla Firefox\gmp-clearkey\0.1\clearkey.info
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
UDP
- DNS ASK go.microsoft.com
- DNS ASK settings-win.data.microsoft.com
- DNS ASK share.microsoft.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet
- '<SYSTEM32>\wbengine.exe'
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\devicecensus.exe' UserCxt
