Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BabyLockerKZ' = '"<Full path to file>"'
Creates the following files on removable media
- <Drive name for removable media>:\return_data.html
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Injects code into
the following system processes:
- <SYSTEM32>\vssadmin.exe
Modifies file system
Creates the following files
- <Current directory>\output.bmp
- %CommonProgramFiles%\microsoft shared\themes14\pixel\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\profile\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\quad\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\radial\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\refined\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\ricepapr\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\ripple\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\rmnsque\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\satin\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\sky\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\slate\return_data.html
- %CommonProgramFiles%\microsoft shared\triedit\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\sonora\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\strtedge\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\studio\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\sumipntg\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\water\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\watermar\return_data.html
- %CommonProgramFiles%\microsoft shared\translat\return_data.html
- %CommonProgramFiles%\microsoft shared\translat\arfr\return_data.html
- %CommonProgramFiles%\microsoft shared\translat\enes\return_data.html
- %CommonProgramFiles%\microsoft shared\translat\enfr\return_data.html
- %CommonProgramFiles%\microsoft shared\translat\esen\return_data.html
- %CommonProgramFiles%\microsoft shared\translat\frar\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\network\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\papyrus\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\spring\return_data.html
- %CommonProgramFiles%\microsoft shared\translat\fren\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\journal\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\arctic\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\axis\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\blends\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\breeze\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\canyon\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\capsules\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\cascade\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\compass\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\concrete\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\echo\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\edge\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\evrgreen\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\expeditn\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\ice\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\indust\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\iris\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\layers\return_data.html
- %CommonProgramFiles%\microsoft shared\textconv\return_data.html
- %CommonProgramFiles%\microsoft shared\themes14\level\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\return_data.html
- %CommonProgramFiles%\microsoft shared\triedit\en-us\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\flippage\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\full\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\memories\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\oldage\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\performance\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\pets\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\push\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\return_data.html
- %CommonProgramFiles%\microsoft shared\vba\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\shatter\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\sports\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\stacking\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\travel\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\videowall\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\vignette\return_data.html
- %ProgramFiles%\internet explorer\return_data.html
- %ProgramFiles%\internet explorer\en-us\return_data.html
- %ProgramFiles%\internet explorer\signup\return_data.html
- %ProgramFiles%\java\return_data.html
- %ProgramFiles%\java\jre1.8.0_45\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\return_data.html
- %ProgramFiles%\dvd maker\shared\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\return_data.html
- %ProgramFiles%\dvd maker\en-us\return_data.html
- %ProgramFiles%\dvd maker\return_data.html
- %CommonProgramFiles%\microsoft shared\vba\vba7\return_data.html
- %CommonProgramFiles%\microsoft shared\vc\return_data.html
- %CommonProgramFiles%\microsoft shared\vgx\return_data.html
- %CommonProgramFiles%\microsoft shared\vsto\return_data.html
- %CommonProgramFiles%\microsoft shared\vsto\10.0\return_data.html
- %CommonProgramFiles%\microsoft shared\vsto\10.0\1033\return_data.html
- %CommonProgramFiles%\microsoft shared\web folders\return_data.html
- %CommonProgramFiles%\microsoft shared\web folders\1033\return_data.html
- %CommonProgramFiles%\microsoft shared\web server extensions\return_data.html
- %CommonProgramFiles%\microsoft shared\web server extensions\14\return_data.html
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\return_data.html
- %CommonProgramFiles%\microsoft shared\stationery\return_data.html
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\return_data.html
- %CommonProgramFiles%\microsoft shared\textconv\en-us\return_data.html
- %CommonProgramFiles%\speechengines\return_data.html
- %CommonProgramFiles%\system\return_data.html
- %CommonProgramFiles%\system\ado\return_data.html
- %CommonProgramFiles%\system\ado\en-us\return_data.html
- %CommonProgramFiles%\system\en-us\return_data.html
- %CommonProgramFiles%\system\msadc\return_data.html
- %CommonProgramFiles%\system\msadc\en-us\return_data.html
- %CommonProgramFiles%\system\msmapi\return_data.html
- %CommonProgramFiles%\system\msmapi\1033\return_data.html
- %CommonProgramFiles%\system\ole db\return_data.html
- %CommonProgramFiles%\system\ole db\en-us\return_data.html
- %CommonProgramFiles%\services\return_data.html
- %CommonProgramFiles%\microsoft shared\vba\vba7\1033\return_data.html
- %CommonProgramFiles%\speechengines\microsoft\return_data.html
- %CommonProgramFiles%\microsoft shared\source engine\return_data.html
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\return_data.html
- %CommonProgramFiles%\microsoft shared\smart tag\lists\return_data.html
- %CommonProgramFiles%\microsoft shared\dw\return_data.html
- %CommonProgramFiles%\microsoft shared\equation\return_data.html
- %CommonProgramFiles%\microsoft shared\equation\1033\return_data.html
- %CommonProgramFiles%\microsoft shared\euro\return_data.html
- %CommonProgramFiles%\microsoft shared\filters\return_data.html
- %CommonProgramFiles%\microsoft shared\grphflt\return_data.html
- %CommonProgramFiles%\microsoft shared\help\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\ar-sa\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\bg-bg\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\cs-cz\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\da-dk\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\de-de\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\el-gr\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\es-es\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\et-ee\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fi-fi\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fr-fr\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\return_data.html
- %CommonProgramFiles%\return_data.html
- <Current directory>\return_data.html
- %CommonProgramFiles%\microsoft shared\return_data.html
- %ProgramFiles%\return_data.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\return_data.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\return_data.html
- D:\return_data.html
- D:\$recycle.bin\return_data.html
- C:\return_data.html
- C:\$recycle.bin\return_data.html
- a:\bootsect.bak
- C:\kms\return_data.html
- C:\msocache\return_data.html
- C:\msocache\all users\return_data.html
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\return_data.html
- %ProgramFiles%\java\jre1.8.0_45\bin\return_data.html
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\return_data.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\return_data.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\return_data.html
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\return_data.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\return_data.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\return_data.html
- a:\return_data.html
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\return_data.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\cultures\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\return_data.html
- %CommonProgramFiles%\designer\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\return_data.html
- %CommonProgramFiles%\microsoft shared\proof\return_data.html
- %CommonProgramFiles%\microsoft shared\smart tag\return_data.html
- %CommonProgramFiles%\microsoft shared\smart tag\1033\return_data.html
- %CommonProgramFiles%\microsoft shared\msinfo\en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\1033\return_data.html
- %CommonProgramFiles%\microsoft shared\office14\return_data.html
- %CommonProgramFiles%\microsoft shared\msinfo\return_data.html
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\he-il\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\hr-hr\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\hu-hu\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\hwrcustomization\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\it-it\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\ja-jp\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\ko-kr\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\lt-lt\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\lv-lv\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\nb-no\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\nl-nl\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\pt-br\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\ro-ro\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\ru-ru\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\sk-sk\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\sl-si\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\sv-se\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\th-th\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\tr-tr\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\uk-ua\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\zh-cn\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\zh-tw\return_data.html
- %CommonProgramFiles%\microsoft shared\ink\pt-pt\return_data.html
- %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\return_data.html
Moves the following files
- from a:\bootsect.bak to a:\bootsect.bak.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00932_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00932_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00135_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00135_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00100_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00100_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00092_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00092_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00078_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00078_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00076_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00076_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\boatinst.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\boatinst.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\boat.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\boat.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00390_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00390_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00923_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00923_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00921_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00921_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00648_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00648_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00526_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00526_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00525_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00525_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00524_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00524_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00392_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00392_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00985_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00985_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06102_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06102_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04385_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04385_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19988_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19988_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00136_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00136_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00145_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00145_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00174_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00184_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01157_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01157_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01152_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01152_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01151_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01151_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01146_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01146_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01145_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01145_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01143_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01143_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01140_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01140_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01160_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01160_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01139_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01139_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01039_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01039_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01015_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01015_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00705_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00705_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00687_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00687_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00449_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00449_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00448_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00448_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00437_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00437_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01138_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01138_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01162_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01162_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01163_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01163_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01166_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01166_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01585_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01585_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01366_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01366_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01186_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01186_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01183_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01183_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01182_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01182_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01181_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01181_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01180_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01180_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01179_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01179_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01178_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01178_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01176_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01176_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01173_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01172_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01172_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01171_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01171_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01170_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01170_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01169_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01169_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01168_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01168_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01167_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01167_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00414_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00414_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00407_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00407_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00413_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00413_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00405_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00405_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01635_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01635_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01634_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01634_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01603_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01603_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01080_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01080_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00453_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00453_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00445_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00445_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00444_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00444_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01636_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01636_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00443_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00443_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00441_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00441_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00440_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00440_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00439_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00439_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00438_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00438_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00224_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00224_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00200_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00200_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00186_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00186_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00442_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00442_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01637_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01637_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01638_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01638_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\bs01639_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs01639_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00297_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00297_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00261_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00261_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00256_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00256_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00255_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00255_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00234_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00234_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00121_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00121_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00117_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00117_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\cupinst.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\cupinst.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\cup.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\cup.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\craninst.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\craninst.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\crane.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\crane.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\cmnty_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\cmnty_01.mid.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\clip.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\clip.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\classic2.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\classic2.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\classic1.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\classic1.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\cg1606.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\cg1606.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\carbn_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\carbn_01.mid.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01586_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01586_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04269_.wmf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar to %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\net.properties to %ProgramFiles%\java\jre1.8.0_45\lib\net.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklisted.certs to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklisted.certs.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties to %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\currency.data to %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\classlist to %ProgramFiles%\java\jre1.8.0_45\lib\classlist.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.danger
- from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.danger
- from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.danger
- from %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl to %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\security\java.policy to %ProgramFiles%\java\jre1.8.0_45\lib\security\java.policy.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\security\java.security to %ProgramFiles%\java\jre1.8.0_45\lib\security\java.security.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04235_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04235_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04225_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04225_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\informix.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\informix.xsl.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as90.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as90.xsl.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.danger
- from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.danger
- from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.danger
- from %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties to %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties.danger
- from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\an04267_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04267_.wmf.danger
- from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01628_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01628_.wmf.danger
Modifies the following files
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\pss10r.chm
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\microsoft.vc90.crt.manifest
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.chm
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ap#.#pify.org':443
TCP
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive"
- '%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
- '%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
- '<SYSTEM32>\cmd.exe' /c wbadmin delete backup -keepVersion:0 -quiet
- '<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoverynabled No
- '<SYSTEM32>\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive"
- '<SYSTEM32>\wbadmin.exe' delete backup -keepVersion:0 -quiet
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
- '<SYSTEM32>\bcdedit.exe' /set {default} recoverynabled No
- '<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive"
- '<SYSTEM32>\cmd.exe' /c pause