Trojan.Encoder.40696

Technical Information

Modifies file system

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\readme.txt to %ProgramFiles%\java\jre1.8.0_45\readme.txt.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\velvetrose.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\velvetrose.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\greentea.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\greentea.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\earthy.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\earthy.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\country.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\country.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\casual.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\casual.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\adobe.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\adobe.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\validation.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\validation.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\utilityfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\utilityfunctions.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\publicfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\publicfunctions.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\form_edit.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\form_edit.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lightspirit.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lightspirit.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formshomepagestyle.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formshomepagestyle.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\maroon.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\maroon.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\validation.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\validation.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\utilityfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\utilityfunctions.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\publicfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\publicfunctions.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\form_edit.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\form_edit.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\velvetrose.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\velvetrose.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\texturedblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\texturedblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\teal.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\teal.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\maroon.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\maroon.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slateblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slateblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\premium.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\premium.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\olivegreen.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\olivegreen.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formshomepagescript.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formshomepagescript.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\texturedblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\texturedblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\teal.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\teal.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\adobe.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\adobe.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\validation.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\validation.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\utilityfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\utilityfunctions.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\publicfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\publicfunctions.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\form_edit.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\form_edit.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formshomepagestyle.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formshomepagestyle.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formshomepagescript.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formshomepagescript.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\viewselectionchanged.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\viewselectionchanged.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\viewdblclick.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\viewdblclick.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\validation.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\validation.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\utilityfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\utilityfunctions.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formshomepagestyle.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formshomepagestyle.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formshomepagescript.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formshomepagescript.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\sounds\people\whistling.wav to %ProgramFiles%\microsoft office\office14\groove\sounds\people\whistling.wav.encrypted
from %ProgramFiles%\microsoft office\office14\en\microsoft.office.sharepointworkspace.addin.intl.resources.dll to %ProgramFiles%\microsoft office\office14\en\microsoft.office.sharepointworkspace.addin.intl.resources.dll.encrypted
from %ProgramFiles%\microsoft office\office14\addins\umoutlookaddin.dll to %ProgramFiles%\microsoft office\office14\addins\umoutlookaddin.dll.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\casual.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\casual.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slateblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slateblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\premium.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\premium.css.encrypted
from %ProgramFiles%\microsoft office\office14\addins\otkloadr_x64.dll to %ProgramFiles%\microsoft office\office14\addins\otkloadr_x64.dll.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\olivegreen.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\olivegreen.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lightspirit.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lightspirit.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\greentea.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\greentea.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\earthy.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\earthy.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\country.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\country.css.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\hierarchy.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\hierarchy.js.encrypted
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\infopathom\microsoft.office.infopath.dll to %ProgramFiles%\microsoft office\office14\infopathom\microsoft.office.infopath.dll.encrypted
from %ProgramFiles%\mozilla firefox\accessiblemarshal.dll to %ProgramFiles%\mozilla firefox\accessiblemarshal.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\ldif60.dll to %ProgramFiles%\mozilla thunderbird\ldif60.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\ldap60.dll to %ProgramFiles%\mozilla thunderbird\ldap60.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\install.log to %ProgramFiles%\mozilla thunderbird\install.log.encrypted
from %ProgramFiles%\mozilla thunderbird\ia2marshal.dll to %ProgramFiles%\mozilla thunderbird\ia2marshal.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\freebl3.dll to %ProgramFiles%\mozilla thunderbird\freebl3.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\d3dcompiler_47.dll to %ProgramFiles%\mozilla thunderbird\d3dcompiler_47.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-utility-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-utility-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-time-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-time-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-string-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-string-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-stdio-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-stdio-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-runtime-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-runtime-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-process-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-process-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-private-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-private-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-multibyte-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-multibyte-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-math-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-math-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-locale-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-locale-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-heap-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-heap-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-environment-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-environment-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-filesystem-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-filesystem-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\lgpllibs.dll to %ProgramFiles%\mozilla thunderbird\lgpllibs.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\libegl.dll to %ProgramFiles%\mozilla thunderbird\libegl.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\softokn3.dll to %ProgramFiles%\mozilla thunderbird\softokn3.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\rnp.dll to %ProgramFiles%\mozilla thunderbird\rnp.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\qipcap64.dll to %ProgramFiles%\mozilla thunderbird\qipcap64.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\prldap60.dll to %ProgramFiles%\mozilla thunderbird\prldap60.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\osclientcerts.dll to %ProgramFiles%\mozilla thunderbird\osclientcerts.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\nssckbi.dll to %ProgramFiles%\mozilla thunderbird\nssckbi.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\nss3.dll to %ProgramFiles%\mozilla thunderbird\nss3.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\msvcp140.dll to %ProgramFiles%\mozilla thunderbird\msvcp140.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\mozmapi32.dll to %ProgramFiles%\mozilla thunderbird\mozmapi32.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-conio-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-conio-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\mozglue.dll to %ProgramFiles%\mozilla thunderbird\mozglue.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\mapiproxy_inuse.dll to %ProgramFiles%\mozilla thunderbird\mapiproxy_inuse.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\mapiproxy.dll to %ProgramFiles%\mozilla thunderbird\mapiproxy.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\libssp-0.dll to %ProgramFiles%\mozilla thunderbird\libssp-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\libotr-5.dll to %ProgramFiles%\mozilla thunderbird\libotr-5.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\libgpg-error6-0.dll to %ProgramFiles%\mozilla thunderbird\libgpg-error6-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\libglesv2.dll to %ProgramFiles%\mozilla thunderbird\libglesv2.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\libgcrypt-20.dll to %ProgramFiles%\mozilla thunderbird\libgcrypt-20.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-convert-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-convert-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-timezone-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-timezone-l1-1-0.dll.encrypted
from %ProgramFiles%\microsoft office\office14\nl7models000c.dll to %ProgramFiles%\microsoft office\office14\nl7models000c.dll.encrypted
from %ProgramFiles%\mozilla firefox\api-ms-win-crt-conio-l1-1-0.dll to %ProgramFiles%\mozilla firefox\api-ms-win-crt-conio-l1-1-0.dll.encrypted
from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.sqlserverce.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.sqlserverce.dll.encrypted
from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.server.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.server.dll.encrypted
from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.dll.encrypted
from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\synchronization.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\synchronization.dll.encrypted
from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\microsoft.synchronization.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\microsoft.synchronization.dll.encrypted
from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\feedsync.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\feedsync.dll.encrypted
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll.encrypted
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll.encrypted
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll.encrypted
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll.encrypted
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll.encrypted
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll.encrypted
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onenote\sendtoonenoteui.dll to %ProgramFiles%\microsoft office\office14\onenote\sendtoonenoteui.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onenote\sendtoonenotefilter.dll to %ProgramFiles%\microsoft office\office14\onenote\sendtoonenotefilter.dll.encrypted
from %ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\microsoft.office.infopath.dll to %ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\microsoft.office.infopath.dll.encrypted
from %ProgramFiles%\mozilla firefox\api-ms-win-crt-private-l1-1-0.dll to %ProgramFiles%\mozilla firefox\api-ms-win-crt-private-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla firefox\api-ms-win-crt-process-l1-1-0.dll to %ProgramFiles%\mozilla firefox\api-ms-win-crt-process-l1-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-synch-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-synch-l1-2-0.dll.encrypted
from %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll to %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.encrypted
from %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json to %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-processthreads-l1-1-1.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-processthreads-l1-1-1.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-localization-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-localization-l1-2-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l2-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l2-1-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l1-2-0.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles%\mozilla thunderbird\accessiblemarshal.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\accessiblehandler.dll to %ProgramFiles%\mozilla thunderbird\accessiblehandler.dll.encrypted
from %ProgramFiles%\mozilla firefox\uninstall\uninstall.log to %ProgramFiles%\mozilla firefox\uninstall\uninstall.log.encrypted
from %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\microsoft.office.infopath.dll to %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\microsoft.office.infopath.dll.encrypted
from %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\microsoft.office.infopath.dll to %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\microsoft.office.infopath.dll.encrypted
from %ProgramFiles%\mozilla firefox\accessiblehandler.dll to %ProgramFiles%\mozilla firefox\accessiblehandler.dll.encrypted
from %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js to %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js.encrypted
from %ProgramFiles%\mozilla firefox\qipcap64.dll to %ProgramFiles%\mozilla firefox\qipcap64.dll.encrypted
from %ProgramFiles%\mozilla firefox\osclientcerts.dll to %ProgramFiles%\mozilla firefox\osclientcerts.dll.encrypted
from %ProgramFiles%\mozilla firefox\libglesv2.dll to %ProgramFiles%\mozilla firefox\libglesv2.dll.encrypted
from %ProgramFiles%\mozilla firefox\libegl.dll to %ProgramFiles%\mozilla firefox\libegl.dll.encrypted
from %ProgramFiles%\mozilla firefox\install.log to %ProgramFiles%\mozilla firefox\install.log.encrypted
from %ProgramFiles%\mozilla firefox\ia2marshal.dll to %ProgramFiles%\mozilla firefox\ia2marshal.dll.encrypted
from %ProgramFiles%\mozilla firefox\distibution\policies.json to %ProgramFiles%\mozilla firefox\distibution\policies.json.encrypted
from %ProgramFiles%\microsoft office\office14\addins\colleagueimport.dll to %ProgramFiles%\microsoft office\office14\addins\colleagueimport.dll.encrypted
from %ProgramFiles%\microsoft office\office14\addins\bcsaddin.dll to %ProgramFiles%\microsoft office\office14\addins\bcsaddin.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\velvetrose.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\velvetrose.css.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\management.dll to %ProgramFiles%\java\jre1.8.0_45\bin\management.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\unpack.dll to %ProgramFiles%\java\jre1.8.0_45\bin\unpack.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\t2k.dll to %ProgramFiles%\java\jre1.8.0_45\bin\t2k.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\sunmscapi.dll to %ProgramFiles%\java\jre1.8.0_45\bin\sunmscapi.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\sunec.dll to %ProgramFiles%\java\jre1.8.0_45\bin\sunec.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\ssv.dll to %ProgramFiles%\java\jre1.8.0_45\bin\ssv.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\splashscreen.dll to %ProgramFiles%\java\jre1.8.0_45\bin\splashscreen.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\resource.dll to %ProgramFiles%\java\jre1.8.0_45\bin\resource.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\prism_sw.dll to %ProgramFiles%\java\jre1.8.0_45\bin\prism_sw.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\prism_es2.dll to %ProgramFiles%\java\jre1.8.0_45\bin\prism_es2.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\prism_d3d.dll to %ProgramFiles%\java\jre1.8.0_45\bin\prism_d3d.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\prism_common.dll to %ProgramFiles%\java\jre1.8.0_45\bin\prism_common.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\npt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\npt.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\nio.dll to %ProgramFiles%\java\jre1.8.0_45\bin\nio.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\net.dll to %ProgramFiles%\java\jre1.8.0_45\bin\net.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\msvcr100.dll to %ProgramFiles%\java\jre1.8.0_45\bin\msvcr100.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\mlib_image.dll to %ProgramFiles%\java\jre1.8.0_45\bin\mlib_image.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\windowsaccessbridge-64.dll to %ProgramFiles%\java\jre1.8.0_45\bin\windowsaccessbridge-64.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\w2k_lsa_auth.dll to %ProgramFiles%\java\jre1.8.0_45\bin\w2k_lsa_auth.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\zip.dll to %ProgramFiles%\java\jre1.8.0_45\bin\zip.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\lcms.dll to %ProgramFiles%\java\jre1.8.0_45\bin\lcms.dll.encrypted
from %ProgramFiles%\microsoft office\office14\bcsruntime.dll to %ProgramFiles%\microsoft office\office14\bcsruntime.dll.encrypted
from %ProgramFiles%\microsoft office\office14\bcsproxy.dll to %ProgramFiles%\microsoft office\office14\bcsproxy.dll.encrypted
from %ProgramFiles%\microsoft office\office14\bcslaunch.dll to %ProgramFiles%\microsoft office\office14\bcslaunch.dll.encrypted
from %ProgramFiles%\microsoft office\office14\bcsclient.msg.dll to %ProgramFiles%\microsoft office\office14\bcsclient.msg.dll.encrypted
from %ProgramFiles%\microsoft office\office14\bcsautogen.dll to %ProgramFiles%\microsoft office\office14\bcsautogen.dll.encrypted
from %ProgramFiles%\microsoft analysis services\as oledb\10\msolui100.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msolui100.dll.encrypted
from %ProgramFiles%\microsoft analysis services\as oledb\10\msolap100.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msolap100.dll.encrypted
from %ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.encrypted
from %ProgramFiles%\microsoft office\office14\contactpicker.dll to %ProgramFiles%\microsoft office\office14\contactpicker.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\server\jvm.dll to %ProgramFiles%\java\jre1.8.0_45\bin\server\jvm.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\plugin2\npjp2.dll to %ProgramFiles%\java\jre1.8.0_45\bin\plugin2\npjp2.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\plugin2\msvcr100.dll to %ProgramFiles%\java\jre1.8.0_45\bin\plugin2\msvcr100.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\npdeployjava1.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\npdeployjava1.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\deployjava1.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\deployjava1.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\wsdetect.dll to %ProgramFiles%\java\jre1.8.0_45\bin\wsdetect.dll.encrypted
from %ProgramFiles%\microsoft office\office14\bcsruntimeui.dll to %ProgramFiles%\microsoft office\office14\bcsruntimeui.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\kcms.dll to %ProgramFiles%\java\jre1.8.0_45\bin\kcms.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jsoundds.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jsoundds.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\instrument.dll to %ProgramFiles%\java\jre1.8.0_45\bin\instrument.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\gstreamer-lite.dll to %ProgramFiles%\java\jre1.8.0_45\bin\gstreamer-lite.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\glib-lite.dll to %ProgramFiles%\java\jre1.8.0_45\bin\glib-lite.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\glass.dll to %ProgramFiles%\java\jre1.8.0_45\bin\glass.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\fxplugins.dll to %ProgramFiles%\java\jre1.8.0_45\bin\fxplugins.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\fontmanager.dll to %ProgramFiles%\java\jre1.8.0_45\bin\fontmanager.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\eula.dll to %ProgramFiles%\java\jre1.8.0_45\bin\eula.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\dt_socket.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dt_socket.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\dt_shmem.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dt_shmem.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\deploy.dll to %ProgramFiles%\java\jre1.8.0_45\bin\deploy.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\decora_sse.dll to %ProgramFiles%\java\jre1.8.0_45\bin\decora_sse.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\dcpr.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dcpr.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\bci.dll to %ProgramFiles%\java\jre1.8.0_45\bin\bci.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.encrypted
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\j2pcsc.dll to %ProgramFiles%\java\jre1.8.0_45\bin\j2pcsc.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\j2pkcs11.dll to %ProgramFiles%\java\jre1.8.0_45\bin\j2pkcs11.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jaas_nt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jaas_nt.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\hprof.dll to %ProgramFiles%\java\jre1.8.0_45\bin\hprof.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\java.dll to %ProgramFiles%\java\jre1.8.0_45\bin\java.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jsdt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jsdt.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jsound.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jsound.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jpeg.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jpeg.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jp2ssv.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jp2ssv.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jp2native.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jp2native.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jp2iexp.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jp2iexp.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jli.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jli.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll.encrypted
from %ProgramFiles%\microsoft office\office14\bcsstr32.dll to %ProgramFiles%\microsoft office\office14\bcsstr32.dll.encrypted
from %ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jfxmedia.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jfxmedia.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jawtaccessbridge-64.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jawtaccessbridge-64.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jawt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jawt.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\java_crw_demo.dll to %ProgramFiles%\java\jre1.8.0_45\bin\java_crw_demo.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\javafx_iio.dll to %ProgramFiles%\java\jre1.8.0_45\bin\javafx_iio.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\javafx_font_t2k.dll to %ProgramFiles%\java\jre1.8.0_45\bin\javafx_font_t2k.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\javafx_font.dll to %ProgramFiles%\java\jre1.8.0_45\bin\javafx_font.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\javaaccessbridge-64.dll to %ProgramFiles%\java\jre1.8.0_45\bin\javaaccessbridge-64.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jfr.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jfr.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\jdwp.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jdwp.dll.encrypted
from %ProgramFiles%\java\jre1.8.0_45\bin\verify.dll to %ProgramFiles%\java\jre1.8.0_45\bin\verify.dll.encrypted
from %ProgramFiles%\microsoft office\office14\entitydatahandler.dll to %ProgramFiles%\microsoft office\office14\entitydatahandler.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\earthy.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\earthy.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\greentea.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\greentea.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\discussion.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\discussion.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\casual.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\casual.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\beige.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\beige.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\adobe.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\adobe.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\wxpr.dll to %ProgramFiles%\microsoft office\office14\1033\wxpr.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\umoutlookstrings.dll to %ProgramFiles%\microsoft office\office14\1033\umoutlookstrings.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\ospintl.dll to %ProgramFiles%\microsoft office\office14\1033\ospintl.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\onenotesyncpcintl.dll to %ProgramFiles%\microsoft office\office14\1033\onenotesyncpcintl.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\entitypickerintl.dll to %ProgramFiles%\microsoft office\office14\1033\entitypickerintl.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\contactpickerintl.dll to %ProgramFiles%\microsoft office\office14\1033\contactpickerintl.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lightspirit.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lightspirit.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\texturedblue.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\texturedblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_doc.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_doc.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_generic.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_generic.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\teal.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\teal.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_response.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_response.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_person.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_person.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\bcsruntimeres.dll to %ProgramFiles%\microsoft office\office14\1033\bcsruntimeres.dll.encrypted
from %ProgramFiles%\microsoft office\office14\entitypicker.dll to %ProgramFiles%\microsoft office\office14\entitypicker.dll.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slateblue.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slateblue.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\premium.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\premium.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\olivegreen.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\olivegreen.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\maroon.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\maroon.css.encrypted
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions.css.encrypted
from %ProgramFiles%\mozilla thunderbird\mozmapi32_inuse.dll to %ProgramFiles%\mozilla thunderbird\mozmapi32_inuse.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\ucrtbase.dll to %ProgramFiles%\mozilla thunderbird\ucrtbase.dll.encrypted
from %ProgramFiles%\microsoft office\office14\taxonomycontrol.dll to %ProgramFiles%\microsoft office\office14\taxonomycontrol.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.datasetwrapper.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.datasetwrapper.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.data.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.data.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.xml.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.xml.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.semitrust.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.semitrust.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.infopath.formcontrol.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.infopath.formcontrol.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.infopath.client.internal.clrhost.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.infopath.client.internal.clrhost.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.businessdata.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.businessdata.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtimeui.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtimeui.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtime.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtime.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.businessdata.dll to %ProgramFiles%\microsoft office\office14\microsoft.businessdata.dll.encrypted
from %ProgramFiles%\microsoft office\office14\interop.managedapi.dll to %ProgramFiles%\microsoft office\office14\interop.managedapi.dll.encrypted
from %ProgramFiles%\microsoft office\office14\interop.groovemanagedaddintool.dll to %ProgramFiles%\microsoft office\office14\interop.groovemanagedaddintool.dll.encrypted
from %ProgramFiles%\microsoft office\office14\gkword.dll to %ProgramFiles%\microsoft office\office14\gkword.dll.encrypted
from %ProgramFiles%\microsoft office\office14\gkpowerpoint.dll to %ProgramFiles%\microsoft office\office14\gkpowerpoint.dll.encrypted
from %ProgramFiles%\microsoft office\office14\gkexcel.dll to %ProgramFiles%\microsoft office\office14\gkexcel.dll.encrypted
from %ProgramFiles%\microsoft office\office14\excelcnvpxy.dll to %ProgramFiles%\microsoft office\office14\excelcnvpxy.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.intl.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.intl.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.tool.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.tool.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.interface.dll to %ProgramFiles%\microsoft office\office14\microsoft.office.sharepointworkspace.addin.interface.dll.encrypted
from %ProgramFiles%\microsoft office\office14\microsoft.sharepoint.businessdata.administration.client.dll to %ProgramFiles%\microsoft office\office14\microsoft.sharepoint.businessdata.administration.client.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onwordaddin.dll to %ProgramFiles%\microsoft office\office14\onwordaddin.dll.encrypted
from %ProgramFiles%\microsoft office\office14\mscss7en.dll to %ProgramFiles%\microsoft office\office14\mscss7en.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onpptaddin.dll to %ProgramFiles%\microsoft office\office14\onpptaddin.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onbttnwd.dll to %ProgramFiles%\microsoft office\office14\onbttnwd.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onbttnppt.dll to %ProgramFiles%\microsoft office\office14\onbttnppt.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onbttnol.dll to %ProgramFiles%\microsoft office\office14\onbttnol.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onbttnielinkednotes.dll to %ProgramFiles%\microsoft office\office14\onbttnielinkednotes.dll.encrypted
from %ProgramFiles%\microsoft office\office14\onbttnie.dll to %ProgramFiles%\microsoft office\office14\onbttnie.dll.encrypted
from %ProgramFiles%\microsoft office\office14\oisctrl.dll to %ProgramFiles%\microsoft office\office14\oisctrl.dll.encrypted
from %ProgramFiles%\microsoft office\office14\wordcnvr.dll to %ProgramFiles%\microsoft office\office14\wordcnvr.dll.encrypted
from %ProgramFiles%\microsoft office\office14\wordcnv.dll to %ProgramFiles%\microsoft office\office14\wordcnv.dll.encrypted
from %ProgramFiles%\microsoft office\office14\nl7models000a.dll to %ProgramFiles%\microsoft office\office14\nl7models000a.dll.encrypted
from %ProgramFiles%\microsoft office\office14\nl7models0009.dll to %ProgramFiles%\microsoft office\office14\nl7models0009.dll.encrypted
from %ProgramFiles%\microsoft office\office14\msproof7.dll to %ProgramFiles%\microsoft office\office14\msproof7.dll.encrypted
from %ProgramFiles%\microsoft office\office14\mset7tkjp.dll to %ProgramFiles%\microsoft office\office14\mset7tkjp.dll.encrypted
from %ProgramFiles%\microsoft office\office14\mset7tk.dll to %ProgramFiles%\microsoft office\office14\mset7tk.dll.encrypted
from %ProgramFiles%\microsoft office\office14\mset7.dll to %ProgramFiles%\microsoft office\office14\mset7.dll.encrypted
from %ProgramFiles%\microsoft office\office14\mscss7fr.dll to %ProgramFiles%\microsoft office\office14\mscss7fr.dll.encrypted
from %ProgramFiles%\microsoft office\office14\mscss7es.dll to %ProgramFiles%\microsoft office\office14\mscss7es.dll.encrypted
from %ProgramFiles%\microsoft office\office14\ogalegit.dll to %ProgramFiles%\microsoft office\office14\ogalegit.dll.encrypted
from %ProgramFiles%\mozilla thunderbird\vcruntime140.dll to %ProgramFiles%\mozilla thunderbird\vcruntime140.dll.encrypted

Modifies the following files

C:\kms\kms_vl_all_aio_debug.log
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.msi
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.msi
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.msi
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.msi
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'ph#####dulieumahoa.com':80

TCP

HTTP POST requests

http://www.ph#####dulieumahoa.com/rsdata/createkeys.php
http://www.ph#####dulieumahoa.com/rsdata/savekey.php

UDP

DNS ASK ph#####dulieumahoa.com

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial