Trojan.Encoder.42053

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\dontdeletethisfolder\enc.key
<Имя диска съемного носителя>:\split.avi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
<Имя диска съемного носителя>:\archer.avi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda

Изменения в файловой системе

Создает следующие файлы

C:\dontdeletethisfolder\identifier.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\muauth.cab.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\muoptin.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\oarpmany.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\offrel.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\ophproxy.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\optinps.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\usp10.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\vbajet32.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\wisc30.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\aceintl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\aceodbci.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\acerecr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\acewstr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\alrtintl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\msointl.dll.idx_dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\mssoapr3.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\oarpmanr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\readme.htm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceexcl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\mssoap30.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\msoxmled.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceoddbs.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceodexl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceodtxt.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceoledb.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acer3x.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acerclr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acerep.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acetxt.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acewss.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acexbe.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\expsrv.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\exp_pdf.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\exp_xps.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\fltldr.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\liclua.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\msoicons.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\msoxev.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\scriptcache-current.bin.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\startupcache.8.little.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\msoxmlmf.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceodbc.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\1033\xlsrvintl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\pkeyconfig.companion.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\office32ww.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\onenotemui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\outlookmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\powerpointmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\proof.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\proof.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\proofing.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\proplusww.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\publishermui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\office32mui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\osetupps.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\odeploy.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\pss10o.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\accessmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\accessmuiset.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\excelmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\groovemui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\infopathmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\branding.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\branding.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\oct.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\officemui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\officemuiset.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\osetupui.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\promointl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\psconfig.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\pss10r.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\pkeyconfig-office.xrm-ms.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\setup.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceexch.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acees.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\aceerr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dw20.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwdcw20.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwtrig20.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\dontdeletethisfolder\pubkey.txt
C:\dontdeletethisfolder\enc.txt
C:\dontdeletethisfolder\enc.key
D:\dontdeletethisfolder\enc.key
D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\desktop.ini.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\desktop.ini.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\microsoft.vc90.crt.manifest.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\msvcr90.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\filters\msgfilt.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.flt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.fnt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\epsimp32.flt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\gifimp32.flt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\jpegim32.flt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\ms.cgm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\ms.eps.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\ms.gif.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\ms.jpg.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\ms.png.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\ms.wpg.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\pictim32.flt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\png32.flt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\wpgimp32.flt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\help\msitss55.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\acedao.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\euro\msoeuro.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\equation\mtextra.ttf.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\equation\1033\eeintl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.hlp.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\osetupui.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\pss10r.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\shellui.mst.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\dwintl20.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\wordmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\proof.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\desktop.ini.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\designer\msaddndr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\dw\dw20.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\dw\dwtrig20.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.cnt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.manifest.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppc.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda

Перемещает следующие системные файлы

%WINDIR%\assembly\gac\microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\microsoft.mshtml.dll в %WINDIR%\assembly\gac\microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\microsoft.mshtml.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%WINDIR%\assembly\gac_msil\microsoft.office.businessapplications.syncservices\14.0.0.0__71e9bce111e9429c\microsoft.office.businessapplications.syncservices.dll в %WINDIR%\assembly\gac_msil\microsoft.office.businessapplications.syncservices\14.0.0.0__71e9bce111e9429c\microsoft.office.businessapplications.syncservices.dll.mail-[james.shaw.junior@gmail.com...
%WINDIR%\assembly\gac_msil\microsoft.office.interop.access\14.0.0.0__71e9bce111e9429c\microsoft.office.interop.access.dll в %WINDIR%\assembly\gac_msil\microsoft.office.interop.access\14.0.0.0__71e9bce111e9429c\microsoft.office.interop.access.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%WINDIR%\assembly\gac_msil\microsoft.office.interop.excel\14.0.0.0__71e9bce111e9429c\microsoft.office.interop.excel.dll в %WINDIR%\assembly\gac_msil\microsoft.office.interop.excel\14.0.0.0__71e9bce111e9429c\microsoft.office.interop.excel.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda

Перемещает следующие файлы

%ProgramFiles%\java\jre1.8.0_45\bin\awt.dll в %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx в %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\classicphotoalbum.potx в %ProgramFiles%\microsoft office\templates\1033\classicphotoalbum.potx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\equityreport.dotx в %ProgramFiles%\microsoft office\templates\1033\equityreport.dotx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\fiverules.potx в %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx в %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\training.potx в %ProgramFiles%\microsoft office\templates\1033\training.potx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\news98.poc в %ProgramFiles%\microsoft office\office14\pubwiz\news98.poc.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\web11.poc в %ProgramFiles%\microsoft office\office14\pubwiz\web11.poc.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx в %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\access\northwind.accdt в %ProgramFiles%\microsoft office\templates\1033\access\northwind.accdt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\access\projects.accdt в %ProgramFiles%\microsoft office\templates\1033\access\projects.accdt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\notebook03.onepkg в %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\notebook03.onepkg.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll в %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla firefox\libglesv2.dll в %ProgramFiles%\mozilla firefox\libglesv2.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla firefox\omni.ja в %ProgramFiles%\mozilla firefox\omni.ja.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla firefox\browser\omni.ja в %ProgramFiles%\mozilla firefox\browser\omni.ja.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf в %ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\d3dcompiler_47.dll в %ProgramFiles%\mozilla thunderbird\d3dcompiler_47.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\access\charitable contributions.accdt в %ProgramFiles%\microsoft office\templates\1033\access\charitable contributions.accdt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\templates\1033\access\marketing projects.accdt в %ProgramFiles%\microsoft office\templates\1033\access\marketing projects.accdt.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\libglesv2.dll в %ProgramFiles%\mozilla thunderbird\libglesv2.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\libgcrypt-20.dll в %ProgramFiles%\mozilla thunderbird\libgcrypt-20.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\flyer.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\flyer.dpv.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx в %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pagesize\pglbl002.xml в %ProgramFiles%\microsoft office\office14\pagesize\pglbl002.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pagesize\pglbl048.xml в %ProgramFiles%\microsoft office\office14\pagesize\pglbl048.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pagesize\pgmn081.xml в %ProgramFiles%\microsoft office\office14\pagesize\pgmn081.xml.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\msgr3en.lex в %ProgramFiles%\microsoft office\office14\proof\msgr3en.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\msgr3es.lex в %ProgramFiles%\microsoft office\office14\proof\msgr3es.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\mssp7en.dll в %ProgramFiles%\microsoft office\office14\proof\mssp7en.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\mssp7en.lex в %ProgramFiles%\microsoft office\office14\proof\mssp7en.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\mssp7es.dll в %ProgramFiles%\microsoft office\office14\proof\mssp7es.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu в %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\invite.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\invite.dpv.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\mssp7es.lex в %ProgramFiles%\microsoft office\office14\proof\mssp7es.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\msth7es.lex в %ProgramFiles%\microsoft office\office14\proof\msth7es.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\msth7fr.lex в %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\1033\msgr3en.dll в %ProgramFiles%\microsoft office\office14\proof\1033\msgr3en.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\1036\msgr3fr.dll в %ProgramFiles%\microsoft office\office14\proof\1036\msgr3fr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\3082\msgr3es.dll в %ProgramFiles%\microsoft office\office14\proof\3082\msgr3es.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\bizform.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\bizform.dpv.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\brchur98.poc в %ProgramFiles%\microsoft office\office14\pubwiz\brchur98.poc.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\calendar.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\calendar.dpv.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pubwiz\calndr98.poc в %ProgramFiles%\microsoft office\office14\pubwiz\calndr98.poc.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\mssp7fr.dll в %ProgramFiles%\microsoft office\office14\proof\mssp7fr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\mssp7fr.lex в %ProgramFiles%\microsoft office\office14\proof\mssp7fr.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\proof\msth7en.lex в %ProgramFiles%\microsoft office\office14\proof\msth7en.lex.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\nl7models0011.dll в %ProgramFiles%\microsoft office\office14\nl7models0011.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\libgpg-error6-0.dll в %ProgramFiles%\mozilla thunderbird\libgpg-error6-0.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll в %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.dll в %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\microsoft office\office14\vviewdwg.dll в %ProgramFiles(x86)%\microsoft office\office14\vviewdwg.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\microsoft office\office14\vviewer.dll в %ProgramFiles(x86)%\microsoft office\office14\vviewer.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.mshtml.dll в %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.mshtml.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.dll в %ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\icudtl.dat в %ProgramFiles(x86)%\opera\29.0.1795.47\icudtl.dat.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\installer.exe в %ProgramFiles(x86)%\opera\29.0.1795.47\installer.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\libglesv2.dll в %ProgramFiles(x86)%\opera\29.0.1795.47\libglesv2.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe в %ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\rna-main.js в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\rna-main.js.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak в %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.dll в %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak в %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak в %ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.exe в %ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\osmesa.dll в %ProgramFiles(x86)%\opera\29.0.1795.47\osmesa.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\steam\steam.exe в %ProgramFiles(x86)%\steam\steam.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\steam\bin\steamservice.exe в %ProgramFiles(x86)%\steam\bin\steamservice.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%TEMP%\wallpaper.bmp в %TEMP%\wallpaper.bmp.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%APPDATA%\telegram desktop\telegram.exe в %APPDATA%\telegram desktop\telegram.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%APPDATA%\telegram desktop\unins000.exe в %APPDATA%\telegram desktop\unins000.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak в %ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prcr.x3d в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prcr.x3d.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak в %ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\sendmail.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\sendmail.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\nss3.dll в %ProgramFiles%\mozilla thunderbird\nss3.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\rnp.dll в %ProgramFiles%\mozilla thunderbird\rnp.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\xul.dll в %ProgramFiles%\mozilla thunderbird\xul.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf в %ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\winrar\winrar.exe в %ProgramFiles%\winrar\winrar.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agm.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agm.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cooltype.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cooltype.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pe.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pe.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rt3d.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rt3d.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\omni.ja в %ProgramFiles%\mozilla thunderbird\omni.ja.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\libcef.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\libcef.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\digsig.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\digsig.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia.api.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde в %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\addins\umoutlookaddin.dll в %ProgramFiles%\microsoft office\office14\addins\umoutlookaddin.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde в %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accwiz\acwzlib.accde в %ProgramFiles%\microsoft office\office14\accwiz\acwzlib.accde.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu в %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\gkpowerpoint.dll в %ProgramFiles%\microsoft office\office14\gkpowerpoint.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\gkword.dll в %ProgramFiles%\microsoft office\office14\gkword.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\graph.exe в %ProgramFiles%\microsoft office\office14\graph.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\groove.exe в %ProgramFiles%\microsoft office\office14\groove.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\groovemn.exe в %ProgramFiles%\microsoft office\office14\groovemn.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\infopath.exe в %ProgramFiles%\microsoft office\office14\infopath.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\installed_resources14.xss в %ProgramFiles%\microsoft office\office14\installed_resources14.xss.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\ipdesign.dll в %ProgramFiles%\microsoft office\office14\ipdesign.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\ipeditor.dll в %ProgramFiles%\microsoft office\office14\ipeditor.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\excelcnv.exe в %ProgramFiles%\microsoft office\office14\excelcnv.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\emsmdb32.dll в %ProgramFiles%\microsoft office\office14\emsmdb32.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\gkexcel.dll в %ProgramFiles%\microsoft office\office14\gkexcel.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\msaccess.exe в %ProgramFiles%\microsoft office\office14\msaccess.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mset7fr.kic в %ProgramFiles%\microsoft office\office14\mset7fr.kic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mset7ge.kic в %ProgramFiles%\microsoft office\office14\mset7ge.kic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mset7jp.kic в %ProgramFiles%\microsoft office\office14\mset7jp.kic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mset7tkjp.dll в %ProgramFiles%\microsoft office\office14\mset7tkjp.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mspst32.dll в %ProgramFiles%\microsoft office\office14\mspst32.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mspub.exe в %ProgramFiles%\microsoft office\office14\mspub.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\nl7data0011.dll в %ProgramFiles%\microsoft office\office14\nl7data0011.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\nl7lexicons0011.dll в %ProgramFiles%\microsoft office\office14\nl7lexicons0011.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\nl7models0009.dll в %ProgramFiles%\microsoft office\office14\nl7models0009.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mset7db.kic в %ProgramFiles%\microsoft office\office14\mset7db.kic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mset7en.kic в %ProgramFiles%\microsoft office\office14\mset7en.kic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\mset7es.kic в %ProgramFiles%\microsoft office\office14\mset7es.kic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\excel.exe в %ProgramFiles%\microsoft office\office14\excel.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\dbghelp.dll в %ProgramFiles%\microsoft office\office14\dbghelp.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\nl7models000a.dll в %ProgramFiles%\microsoft office\office14\nl7models000a.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\npdeployjava1.dll в %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\npdeployjava1.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\bin\server\jvm.dll в %ProgramFiles%\java\jre1.8.0_45\bin\server\jvm.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar в %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar в %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar в %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\resources.jar в %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\rt.jar в %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar в %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar в %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar в %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar в %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll в %ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll в %ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft analysis services\as oledb\10\msolap100.dll в %ProgramFiles%\microsoft analysis services\as oledb\10\msolap100.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\document themes 14\couture.thmx в %ProgramFiles%\microsoft office\document themes 14\couture.thmx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\document themes 14\theme effects\couture.eftx в %ProgramFiles%\microsoft office\document themes 14\theme effects\couture.eftx.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accdds.dll в %ProgramFiles%\microsoft office\office14\accdds.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accicons.exe в %ProgramFiles%\microsoft office\office14\accicons.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\accvdt.dll в %ProgramFiles%\microsoft office\office14\accvdt.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\advcmp.dic в %ProgramFiles%\microsoft office\office14\advcmp.dic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\advtel.dic в %ProgramFiles%\microsoft office\office14\advtel.dic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\advzip.dic в %ProgramFiles%\microsoft office\office14\advzip.dic.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\audiosearchmain.dll в %ProgramFiles%\microsoft office\office14\audiosearchmain.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\audiosearchsapife.dll в %ProgramFiles%\microsoft office\office14\audiosearchsapife.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll в %ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\mozilla thunderbird\libotr-5.dll в %ProgramFiles%\mozilla thunderbird\libotr-5.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\nl7models000c.dll в %ProgramFiles%\microsoft office\office14\nl7models000c.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\offowc.dll в %ProgramFiles%\microsoft office\office14\offowc.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\msaccess.hxs в %ProgramFiles%\microsoft office\office14\1033\msaccess.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\msain.dll в %ProgramFiles%\microsoft office\office14\1033\msain.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\mspub.hxs в %ProgramFiles%\microsoft office\office14\1033\mspub.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\onenote.hxs в %ProgramFiles%\microsoft office\office14\1033\onenote.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\onguide.onepkg в %ProgramFiles%\microsoft office\office14\1033\onguide.onepkg.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\onintl.dll в %ProgramFiles%\microsoft office\office14\1033\onintl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\outllibr.dll в %ProgramFiles%\microsoft office\office14\1033\outllibr.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\infopath.hxs в %ProgramFiles%\microsoft office\office14\1033\infopath.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\mapir.dll в %ProgramFiles%\microsoft office\office14\1033\mapir.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\outlook.hxs в %ProgramFiles%\microsoft office\office14\1033\outlook.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs в %ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\ppintl.dll в %ProgramFiles%\microsoft office\office14\1033\ppintl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\psrchlex.dat в %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat в %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\pub6intl.dll в %ProgramFiles%\microsoft office\office14\1033\pub6intl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\winword.hxs в %ProgramFiles%\microsoft office\office14\1033\winword.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\xlintl32.dll в %ProgramFiles%\microsoft office\office14\1033\xlintl32.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\xmlsdk5.chm в %ProgramFiles%\microsoft office\office14\1033\xmlsdk5.chm.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\outlook.hol в %ProgramFiles%\microsoft office\office14\1033\outlook.hol.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\gfx.dll в %ProgramFiles%\microsoft office\office14\gfx.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\ipdsintl.dll в %ProgramFiles%\microsoft office\office14\1033\ipdsintl.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\groove.hxs в %ProgramFiles%\microsoft office\office14\1033\groove.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\excel.hxs в %ProgramFiles%\microsoft office\office14\1033\excel.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\oimg.dll в %ProgramFiles%\microsoft office\office14\oimg.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\oisapp.dll в %ProgramFiles%\microsoft office\office14\oisapp.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\olmapi32.dll в %ProgramFiles%\microsoft office\office14\olmapi32.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\omsmain.dll в %ProgramFiles%\microsoft office\office14\omsmain.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\onenote.exe в %ProgramFiles%\microsoft office\office14\onenote.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\onfilter.dll в %ProgramFiles%\microsoft office\office14\onfilter.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\onmain.dll в %ProgramFiles%\microsoft office\office14\onmain.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\outlfltr.dat в %ProgramFiles%\microsoft office\office14\outlfltr.dat.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\outlook.exe в %ProgramFiles%\microsoft office\office14\outlook.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\powerpnt.exe в %ProgramFiles%\microsoft office\office14\powerpnt.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\oartconv.dll в %ProgramFiles%\microsoft office\office14\oartconv.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\ppcore.dll в %ProgramFiles%\microsoft office\office14\ppcore.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\socialconnector.dll в %ProgramFiles%\microsoft office\office14\socialconnector.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\stslist.dll в %ProgramFiles%\microsoft office\office14\stslist.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\vviewdwg.dll в %ProgramFiles%\microsoft office\office14\vviewdwg.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\vviewer.dll в %ProgramFiles%\microsoft office\office14\vviewer.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\winword.exe в %ProgramFiles%\microsoft office\office14\winword.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\wordcnv.dll в %ProgramFiles%\microsoft office\office14\wordcnv.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\wordicon.exe в %ProgramFiles%\microsoft office\office14\wordicon.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\wwlib.dll в %ProgramFiles%\microsoft office\office14\wwlib.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\ximage3b.dll в %ProgramFiles%\microsoft office\office14\ximage3b.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\xlicons.exe в %ProgramFiles%\microsoft office\office14\xlicons.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\xocr3.psp в %ProgramFiles%\microsoft office\office14\xocr3.psp.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\pptico.exe в %ProgramFiles%\microsoft office\office14\pptico.exe.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%ProgramFiles%\microsoft office\office14\oart.dll в %ProgramFiles%\microsoft office\office14\oart.dll.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda

Изменяет следующие файлы

<Имя диска съемного носителя>:\split.avi
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab.mail-[james.shaw.junior@gmail.com]caseid-[jeyqgmyxhn].lockeda
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi

Изменяет множество файлов.

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней