Ransom.Win32.BURAN.WGP

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %Application Data%\Microsoft\Windows\smss.exe -start
• notepad.exe
• "%Application Data%\Microsoft\Windows\smss.exe" -agent 0
• "%Application Data%\Microsoft\Windows\smss.exe" -agent 1
• "%Application Data%\Microsoft\Windows\smss.exe" -agent 2
• "%System%\cmd.exe" /C net stop "Acronis VSS Provider" /y
• "%System%\cmd.exe" /C net stop "Enterprise Client Service" /y
• "%System%\cmd.exe" /C net stop "SQL Backups" /y
• "%System%\cmd.exe" /C net stop "SQLsafe Backup Service" /y
• "%System%\cmd.exe" /C net stop "SQLsafe Filter Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Agent" /y
• "%System%\cmd.exe" /C net stop "Sophos AutoUpdate Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Clean Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Device Control Service" /y
• "%System%\cmd.exe" /C net stop "Sophos File Scanner Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Health Service" /y
• "%System%\cmd.exe" /C net stop "Sophos MCS Agent" /y
• "%System%\cmd.exe" /C net stop "Sophos MCS Client" /y
• "%System%\cmd.exe" /C net stop "Sophos Message Router" /y
• "%System%\cmd.exe" /C net stop "Sophos Safestore Service" /y
• "%System%\cmd.exe" /C net stop "Sophos System Protection Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Web Control Service" /y
• "%System%\cmd.exe" /C net stop "Symantec System Recovery" /y
• "%System%\cmd.exe" /C net stop "Veeam Backup Catalog Data Service" /y
• "%System%\cmd.exe" /C net stop "Zoolz 2 Service" /y
• "%System%\cmd.exe" /C net stop ARSM /y
• "%System%\cmd.exe" /C net stop AVP /y
• "%System%\cmd.exe" /C net stop AcrSch2Svc /y
• "%System%\cmd.exe" /C net stop AcronisAgent /y
• "%System%\cmd.exe" /C net stop Antivirus /y
• "%System%\cmd.exe" /C net stop BackupExecAgentAccelerator /y
• "%System%\cmd.exe" /C net stop BackupExecAgentBrowser /y
• "%System%\cmd.exe" /C net stop BackupExecDeviceMediaService /y
• "%System%\cmd.exe" /C net stop BackupExecJobEngine /y
• "%System%\cmd.exe" /C net stop BackupExecManagementService /y
• "%System%\cmd.exe" /C net stop BackupExecRPCService /y
• "%System%\cmd.exe" /C net stop BackupExecVSSProvider /y
• "%System%\cmd.exe" /C net stop DCAgent /y
• "%System%\cmd.exe" /C net stop EPSecurityService /y
• "%System%\cmd.exe" /C net stop EPUpdateService /y
• "%System%\cmd.exe" /C net stop ESHASRV /y
• "%System%\cmd.exe" /C net stop EhttpSrv /y
• "%System%\cmd.exe" /C net stop EraserSvc11710 /y
• "%System%\cmd.exe" /C net stop EsgShKernel /y
• "%System%\cmd.exe" /C net stop FA_Scheduler /y
• "%System%\cmd.exe" /C net stop IISAdmin /y
• "%System%\cmd.exe" /C net stop IMAP4Svc /y
• "%System%\cmd.exe" /C net stop KAVFS /y
• "%System%\cmd.exe" /C net stop KAVFSGT /y
• "%System%\cmd.exe" /C net stop MBAMService /y
• "%System%\cmd.exe" /C net stop MBEndpointAgent /y
• "%System%\cmd.exe" /C net stop MMS /y
• "%System%\cmd.exe" /C net stop MSExchangeES /y
• "%System%\cmd.exe" /C net stop MSExchangeIS /y
• "%System%\cmd.exe" /C net stop MSExchangeMGMT /y
• "%System%\cmd.exe" /C net stop MSExchangeMTA /y
• "%System%\cmd.exe" /C net stop MSExchangeSA /y
• "%System%\cmd.exe" /C net stop MSExchangeSRS /y
• "%System%\cmd.exe" /C net stop MSOLAP$SQL_2008 /y
• "%System%\cmd.exe" /C net stop MSOLAP$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop MSOLAP$TPS /y
• "%System%\cmd.exe" /C net stop MSOLAP$TPSAMA /y
• "%System%\cmd.exe" /C net stop MSSQL$BKUPEXEC /y
• "%System%\cmd.exe" /C net stop MSSQL$ECWDB2 /y
• "%System%\cmd.exe" /C net stop MSSQL$PRACTICEMGT /y
• "%System%\cmd.exe" /C net stop MSSQL$PRACTTICEBGC /y
• "%System%\cmd.exe" /C net stop MSSQL$PROD /y
• "%System%\cmd.exe" /C net stop MSSQL$PROFXENGAGEMENT /y
• "%System%\cmd.exe" /C net stop MSSQL$SBSMONITORING /y
• "%System%\cmd.exe" /C net stop MSSQL$SHAREPOINT /y
• "%System%\cmd.exe" /C net stop MSSQL$SOPHOS /y
• "%System%\cmd.exe" /C net stop MSSQL$SQLEXPRESS /y
• "%System%\cmd.exe" /C net stop MSSQL$SQL_2008 /y
• "%System%\cmd.exe" /C net stop MSSQL$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop MSSQL$TPS /y
• "%System%\cmd.exe" /C net stop MSSQL$TPSAMA /y
• "%System%\cmd.exe" /C net stop MSSQL$VEEAMSQL2008R2 /y
• "%System%\cmd.exe" /C net stop MSSQL$VEEAMSQL2012 /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SBSMONITORING /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SHAREPOINT /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SQL_2008 /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$TPS /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$TPSAMA /y
• "%System%\cmd.exe" /C net stop MSSQLSERVER /y
• "%System%\cmd.exe" /C net stop MSSQLServerADHelper /y
• "%System%\cmd.exe" /C net stop MSSQLServerADHelper100 /y
• "%System%\cmd.exe" /C net stop MSSQLServerOLAPService /y
• "%System%\cmd.exe" /C net stop McAfeeEngineService /y
• "%System%\cmd.exe" /C net stop McAfeeFramework /y
• "%System%\cmd.exe" /C net stop McAfeeFrameworkMcAfeeFramework /y
• "%System%\cmd.exe" /C net stop McShield /y
• "%System%\cmd.exe" /C net stop McTaskManager /y
• "%System%\cmd.exe" /C net stop MsDtsServer /y
• "%System%\cmd.exe" /C net stop MsDtsServer100 /y
• "%System%\cmd.exe" /C net stop MsDtsServer110 /y
• "%System%\cmd.exe" /C net stop MySQL57 /y
• "%System%\cmd.exe" /C net stop MySQL80 /y
• "%System%\cmd.exe" /C net stop NetMsmqActivator /y
• "%System%\cmd.exe" /C net stop OracleClientCache80 /y
• "%System%\cmd.exe" /C net stop PDVFSService /y
• "%System%\cmd.exe" /C net stop POP3Svc /y
• "%System%\cmd.exe" /C net stop RESvc /y
• "%System%\cmd.exe" /C net stop ReportServer /y
• "%System%\cmd.exe" /C net stop ReportServer$SQL_2008 /y
• "%System%\cmd.exe" /C net stop ReportServer$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop ReportServer$TPS /y
• "%System%\cmd.exe" /C net stop ReportServer$TPSAMA /y
• "%System%\cmd.exe" /C net stop SAVAdminService /y
• "%System%\cmd.exe" /C net stop SAVService /y
• "%System%\cmd.exe" /C net stop SDRSVC /y
• "%System%\cmd.exe" /C net stop SMTPSvc /y
• "%System%\cmd.exe" /C net stop SNAC /y
• "%System%\cmd.exe" /C net stop SQLAgent$BKUPEXEC /y
• "%System%\cmd.exe" /C net stop SQLAgent$CITRIX_METAFRAME /y
• "%System%\cmd.exe" /C net stop SQLAgent$CXDB /y
• "%System%\cmd.exe" /C net stop SQLAgent$ECWDB2 /y
• "%System%\cmd.exe" /C net stop SQLAgent$PRACTTICEBGC /y
• "%System%\cmd.exe" /C net stop SQLAgent$PRACTTICEMGT /y
• "%System%\cmd.exe" /C net stop SQLAgent$PROD /y
• "%System%\cmd.exe" /C net stop SQLAgent$PROFXENGAGEMENT /y
• "%System%\cmd.exe" /C net stop SQLAgent$SBSMONITORING /y
• "%System%\cmd.exe" /C net stop SQLAgent$SHAREPOINT /y
• "%System%\cmd.exe" /C net stop SQLAgent$SOPHOS /y
• "%System%\cmd.exe" /C net stop SQLAgent$SQLEXPRESS /y
• "%System%\cmd.exe" /C net stop SQLAgent$SQL_2008 /y
• "%System%\cmd.exe" /C net stop SQLAgent$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop SQLAgent$TPS /y
• "%System%\cmd.exe" /C net stop SQLAgent$TPSAMA /y
• "%System%\cmd.exe" /C net stop SQLAgent$VEEAMSQL2008R2 /y
• "%System%\cmd.exe" /C net stop SQLAgent$VEEAMSQL2012 /y
• "%System%\cmd.exe" /C net stop SQLBrowser /y
• "%System%\cmd.exe" /C net stop SQLSERVERAGENT /y
• "%System%\cmd.exe" /C net stop SQLSafeOLRService /y
• "%System%\cmd.exe" /C net stop SQLTELEMETRY /y
• "%System%\cmd.exe" /C net stop SQLTELEMETRY$ECWDB2 /y
• "%System%\cmd.exe" /C net stop SQLWriter /y
• "%System%\cmd.exe" /C net stop SamSs /y
• "%System%\cmd.exe" /C net stop SepMasterService /y
• "%System%\cmd.exe" /C net stop ShMonitor /y
• "%System%\cmd.exe" /C net stop SmcService /y
• "%System%\cmd.exe" /C net stop Smcinst /y
• "%System%\cmd.exe" /C net stop SntpService /y
• "%System%\cmd.exe" /C net stop SstpSvc /y
• "%System%\cmd.exe" /C net stop TmCCSF /y
• "%System%\cmd.exe" /C net stop TrueKey /y
• "%System%\cmd.exe" /C net stop TrueKeyScheduler /y
• "%System%\cmd.exe" /C net stop TrueKeyServiceHelper /y
• "%System%\cmd.exe" /C net stop UI0Detect /y
• "%System%\cmd.exe" /C net stop VeeamBackupSvc /y
• "%System%\cmd.exe" /C net stop VeeamBrokerSvc /y
• "%System%\cmd.exe" /C net stop VeeamCatalogSvc /y
• "%System%\cmd.exe" /C net stop VeeamCloudSvc /y
• "%System%\cmd.exe" /C net stop VeeamDeploySvc /y
• "%System%\cmd.exe" /C net stop VeeamDeploymentService /y
• "%System%\cmd.exe" /C net stop VeeamEnterpriseManagerSvc /y
• "%System%\cmd.exe" /C net stop VeeamHvIntegrationSvc /y
• "%System%\cmd.exe" /C net stop VeeamMountSvc /y
• "%System%\cmd.exe" /C net stop VeeamNFSSvc /y
• "%System%\cmd.exe" /C net stop VeeamRESTSvc /y
• "%System%\cmd.exe" /C net stop VeeamTransportSvc /y
• "%System%\cmd.exe" /C net stop W3Svc /y
• "%System%\cmd.exe" /C net stop WRSVC /y
• "%System%\cmd.exe" /C net stop bedbg /y
• "%System%\cmd.exe" /C net stop ekrn /y
• "%System%\cmd.exe" /C net stop kavfsslp /y
• "%System%\cmd.exe" /C net stop klnagent /y
• "%System%\cmd.exe" /C net stop macmnsvc /y
• "%System%\cmd.exe" /C net stop masvc /y
• "%System%\cmd.exe" /C net stop mfefire /y
• "%System%\cmd.exe" /C net stop mfemms /y
• "%System%\cmd.exe" /C net stop mfevtp /y
• "%System%\cmd.exe" /C net stop mozyprobackup /y
• "%System%\cmd.exe" /C net stop msftesql$PROD /y
• "%System%\cmd.exe" /C net stop ntrtscan /y
• "%System%\cmd.exe" /C net stop sacsvr /y
• "%System%\cmd.exe" /C net stop sophossps /y
• "%System%\cmd.exe" /C net stop svcGenericHost /y
• "%System%\cmd.exe" /C net stop swi_filter /y
• "%System%\cmd.exe" /C net stop swi_service /y
• "%System%\cmd.exe" /C net stop swi_update /y
• "%System%\cmd.exe" /C net stop swi_update_64 /y
• "%System%\cmd.exe" /C net stop tmlisten /y
• "%System%\cmd.exe" /C net stop wbengine /y
• "%System%\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /C bcdedit /set {default} recoveryenabled no
• "%System%\cmd.exe" /C wbadmin delete catalog -quiet
• "%System%\cmd.exe" /C wbadmin delete systemstatebackup
• "%System%\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
• "%System%\cmd.exe" /C wbadmin delete backup
• "%System%\cmd.exe" /C wmic shadowcopy delete
• "%System%\cmd.exe" /C vssadmin delete shadows /all /quiet
• "%System%\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
• "%System%\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
• "%System%\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
• "%System%\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h
• "%System%\cmd.exe" /C del "%userprofile%\documents\Default.rdp"
• "%System%\cmd.exe" /C wevtutil.exe clear-log Application
• "%System%\cmd.exe" /C wevtutil.exe clear-log Security
• "%System%\cmd.exe" /C wevtutil.exe clear-log System
• %System%\net1 stop "Acronis VSS Provider" /y
• %System%\net1 stop "Enterprise Client Service" /y
• %System%\net1 stop "SQL Backups" /y
• %System%\net1 stop "SQLsafe Backup Service" /y
• %System%\net1 stop "SQLsafe Filter Service" /y
• %System%\net1 stop "Sophos Agent" /y
• %System%\net1 stop "Sophos AutoUpdate Service" /y
• %System%\net1 stop "Sophos Clean Service" /y
• %System%\net1 stop "Sophos Device Control Service" /y
• %System%\net1 stop "Sophos File Scanner Service" /y
• %System%\net1 stop "Sophos Health Service" /y
• %System%\net1 stop "Sophos MCS Agent" /y
• %System%\net1 stop "Sophos MCS Client" /y
• %System%\net1 stop "Sophos Message Router" /y
• %System%\net1 stop "Sophos Safestore Service" /y
• %System%\net1 stop "Sophos System Protection Service" /y
• %System%\net1 stop "Sophos Web Control Service" /y
• %System%\net1 stop "Symantec System Recovery" /y
• %System%\net1 stop "Veeam Backup Catalog Data Service" /y
• %System%\net1 stop "Zoolz 2 Service" /y
• %System%\net1 stop ARSM /y
• %System%\net1 stop AVP /y
• %System%\net1 stop AcrSch2Svc /y
• %System%\net1 stop AcronisAgent /y
• %System%\net1 stop Antivirus /y
• %System%\net1 stop BackupExecAgentAccelerator /y
• %System%\net1 stop BackupExecAgentBrowser /y
• %System%\net1 stop BackupExecDeviceMediaService /y
• %System%\net1 stop BackupExecJobEngine /y

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
smss.exe = "%Application Data%\Microsoft\Windows\smss.exe -start"

Other System Modifications

This Ransomware deletes the following files:

• %Application Data%\Microsoft\Windows\smss.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Zeppelin

HKEY_CURRENT_USER\Software\Zeppelin\
Keys

HKEY_CURRENT_USER\Software\Zeppelin\
Paths

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Zeppelin
Process = "X+GNYZYLwJnzqKPDuCxRODtG3ROS6ed1VSwOnaqJU+BpZxedYd7JZA=="

HKEY_CURRENT_USER\Software\Zeppelin\
Keys
Public Key = "{random characters}"

HKEY_CURRENT_USER\Software\Zeppelin\
Keys
Encrypted Private Key = "{random characters}"

HKEY_CURRENT_USER\Software\Zeppelin
Knock = "666"

HKEY_CURRENT_USER\Software\Zeppelin\
Paths
0 = "PiQr+UDQEsfU6W14QPoEicPzqcOBFETyMwbQzoV1GOaUtSbbcjGftcyfke2NhfVhXCQKcQ=="

HKEY_CURRENT_USER\Software\Zeppelin\
Paths
1 = "aY+08c95uYNxUzb1Q7XKWTfgcaUL8xA2lqJTdzDgZKj5VGk="

HKEY_CURRENT_USER\Software\Zeppelin\
Paths
2 = "K2qsZIq8ZC/ECkZkLTxgttTKA2ZKia152od20EtcyhuOdtc="

Dropping Routine

This Ransomware drops the following files:

• %System Root%\Program Files\DVD Maker\Shared\DissolveNoise.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\offset.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png
• %System Root%\Program Files\Microsoft Games\Hearts\HeartsMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv
• %System Root%\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png
• %System Root%\Program Files\Java\jre1.8.0_144\lib\security\trusted.libraries
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\en-US\OmdProject.dll.mui
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Eurosti.TTF
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png
• %System Root%\Program Files\DVD Maker\audiodepthconverter.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\SecretST.TTF
• %System Root%\Program Files\DVD Maker\Shared\Filters.xml
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\fieldswitch.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png
• %User Temp%\806B4554.zeppelin
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\Microsoft Games\Mahjong\MahjongMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png
• %System Root%\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png
• %User Temp%\D202833E.zeppelin
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_extensions.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\en-US.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png
• %System Root%\Program Files\DVD Maker\bod_r.TTF
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png
• %System Root%\Program Files\DVD Maker\Shared\DissolveAnother.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png
• %System Root%\Program Files\VMware\VMware Tools\help\wwhdata\info.txt
• %System Root%\Program Files\DVD Maker\en-US\DVDMaker.exe.mui
• %System Root%\Program Files\VMware\VMware Tools\VMwareTray.exe
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png
• %System Root%\Program Files\DVD Maker\DVDMaker.exe
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin
• %System Root%\Program Files\DVD Maker\directshowtap.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png
• %System Root%\Program Files\VMware\VMware Tools\vmtoolsd.exe
• %System Root%\Program Files\DVD Maker\Shared\Common.fxh
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png
• %System Root%\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png
• %System Root%\Program Files\DVD Maker\sonicsptransform.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\rtstreamsink.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\soniccolorconverter.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png
• %System Root%\Program Files\DVD Maker\rtstreamsource.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat
• %System Root%\Program Files\DVD Maker\Shared\Parity.fx
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv
• %System Root%\Program Files\Microsoft Games\Chess\ChessMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp
• %Application Data%\Microsoft\Windows\smss.exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Ransomware connects to the following possibly malicious URL:

• http://{BLOCKED}ool.com
• http://crt.{BLOCKED}ust.com/GoGetSSLRSADVCA.crt
• http://{BLOCKED}er.org/1i8r57.jpg
• http://{BLOCKED}atool.com

Ransomware Routine

This Ransomware renames encrypted files using the following names:

• {encrypted file}.288-B94-5B8

It drops the following file(s) as ransom note:

• !!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

This report is generated via an automated analysis system.