Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\net.exe' stop wscsvc
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\alert.html.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\release.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\readme.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\copyright.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\license.cookieshelper_tmp
- %ProgramFiles%\java\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\vignette\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\videowall\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\travel\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\stacking\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\sports\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\shatter\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\plugin2\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\server\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\net.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\classlist.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.cookieshelper_tmp
- %ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.cookieshelper_tmp
- %ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\file recovery.txt
- C:\file recovery.txt
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim.cookieshelper_tmp
- %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.cookieshelper_tmp
- %ProgramFiles%\mozilla thunderbird\omni.ja.cookieshelper_tmp
- %ProgramFiles%\mozilla firefox\browser\omni.ja.cookieshelper_tmp
- %ProgramFiles%\mozilla firefox\omni.ja.cookieshelper_tmp
- %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.cookieshelper_tmp
- %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.cookieshelper_tmp
- %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.cookieshelper_tmp
- %ProgramFiles%\microsoft office\office14\installed_resources14.xss.cookieshelper_tmp
- %HOMEPATH%\desktop\file recovery.txt
- %HOMEPATH%\desktop\nwfieldnotes1966.docx.cookieshelper_tmp
- %HOMEPATH%\desktop\ituneshelpunavailable.html.cookieshelper_tmp
- %HOMEPATH%\desktop\iisstart.htm.cookieshelper_tmp
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.cookieshelper_tmp
- %HOMEPATH%\desktop\default.bmp.cookieshelper_tmp
- %HOMEPATH%\desktop\dashborder_192.bmp.cookieshelper_tmp
- %HOMEPATH%\desktop\coffee.bmp.cookieshelper_tmp
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.cookieshelper_tmp
- C:\$recycle.bin\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\pets\file recovery.txt
- <Current directory>\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\performance\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\oldage\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\memories\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\full\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\flippage\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\file recovery.txt
- %ProgramFiles%\dvd maker\shared\file recovery.txt
- %ProgramFiles%\dvd maker\en-us\file recovery.txt
- %ProgramFiles%\dvd maker\file recovery.txt
- %ProgramFiles%\file recovery.txt
- C:\kms\file recovery.txt
- C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\file recovery.txt
- C:\kms\kms_vl_all_aio_debug.log.cookieshelper_tmp
- %ProgramFiles%\dvd maker\shared\dvdstyles\push\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg.cookieshelper_tmp
Deletes the following files
- %HOMEPATH%\desktop\alert.html.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\welcome.html.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\classlist.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\net.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\copyright.cookieshelper_tmp
- C:\users\public\videos\sample videos\wildlife.wmv.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\release.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\license.cookieshelper_tmp
- %HOMEPATH%\desktop\iisstart.htm.cookieshelper_tmp
- %HOMEPATH%\desktop\ituneshelpunavailable.html.cookieshelper_tmp
- %HOMEPATH%\desktop\coffee.bmp.cookieshelper_tmp
- %HOMEPATH%\desktop\pmd.cer.cookieshelper_tmp
- %HOMEPATH%\desktop\dashborder_192.bmp.cookieshelper_tmp
- %HOMEPATH%\desktop\nwfieldnotes1966.docx.cookieshelper_tmp
- %HOMEPATH%\desktop\tree_view.htm.cookieshelper_tmp
- %HOMEPATH%\desktop\tree_view.html.cookieshelper_tmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx.cookieshelper_tmp
- %HOMEPATH%\desktop\default.bmp.cookieshelper_tmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.cookieshelper_tmp
- %HOMEPATH%\desktop\sdszfo.docx.cookieshelper_tmp
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.cookieshelper_tmp
- %HOMEPATH%\desktop\weeklysheet1215.doc.cookieshelper_tmp
- %ProgramFiles%\microsoft office\office14\installed_resources14.xss.cookieshelper_tmp
- %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.cookieshelper_tmp
- %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.cookieshelper_tmp
- %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.cookieshelper_tmp
- %ProgramFiles%\mozilla firefox\omni.ja.cookieshelper_tmp
- %ProgramFiles%\mozilla firefox\browser\omni.ja.cookieshelper_tmp
- %ProgramFiles%\mozilla thunderbird\omni.ja.cookieshelper_tmp
- %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.cookieshelper_tmp
- C:\kms\kms_vl_all_aio_debug.log.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\readme.txt.cookieshelper_tmp
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.cookieshelper_tmp
Moves the following files
- from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\classlist to %ProgramFiles%\java\jre1.8.0_45\lib\classlist.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf.cookieshelper
- from %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\release to %ProgramFiles%\java\jre1.8.0_45\release.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\readme.txt to %ProgramFiles%\java\jre1.8.0_45\readme.txt.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.cookieshelper
- from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.cookieshelper
- from %ProgramFiles%\mozilla firefox\browser\omni.ja to %ProgramFiles%\mozilla firefox\browser\omni.ja.cookieshelper
- from %ProgramFiles%\mozilla firefox\omni.ja to %ProgramFiles%\mozilla firefox\omni.ja.cookieshelper
- from %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx to %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.cookieshelper
- from %ProgramFiles%\microsoft office\templates\1033\fiverules.potx to %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.cookieshelper
- from %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv to %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.cookieshelper
- from %ProgramFiles%\microsoft office\office14\installed_resources14.xss to %ProgramFiles%\microsoft office\office14\installed_resources14.xss.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\currency.data to %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties to %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\net.properties to %ProgramFiles%\java\jre1.8.0_45\lib\net.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties to %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.cookieshelper
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access.cookieshelper
Modifies the following files
- %HOMEPATH%\desktop\alert.html.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\copyright.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\release.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\readme.txt.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\license.cookieshelper
- C:\kms\kms_vl_all_aio_debug.log.cookieshelper
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.cookieshelper
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim.cookieshelper
- %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.cookieshelper
- %ProgramFiles%\mozilla thunderbird\omni.ja.cookieshelper
- %ProgramFiles%\mozilla firefox\browser\omni.ja.cookieshelper
- %ProgramFiles%\mozilla firefox\omni.ja.cookieshelper
- %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.cookieshelper
- %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.cookieshelper
- %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.cookieshelper
- %ProgramFiles%\microsoft office\office14\installed_resources14.xss.cookieshelper
- %HOMEPATH%\desktop\coffee.bmp.cookieshelper
- %HOMEPATH%\desktop\nwfieldnotes1966.docx.cookieshelper
- %HOMEPATH%\desktop\ituneshelpunavailable.html.cookieshelper
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.cookieshelper
- %HOMEPATH%\desktop\iisstart.htm.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.cookieshelper
- %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.cookieshelper
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c net stop wscsvc
- '<SYSTEM32>\net1.exe' stop wscsvc
