Detected by Malwarebytes as Trojan.PasswordStealer.MSIL. The file is located in %AppData%\SubDir

Detected by Dr.Web as Trojan.MulDrop4.53993 and by Malwarebytes as Trojan.Agent.CM

Detected by Malwarebytes as Ransom.Agent.E. Note - this is not the legitimate Microsoft Windows 10/8/7 process with the same filename which is used to host the cmd.exe console window and is located in %System%. This one is located in %CommonAppData%\MicroSoftTMP\system32

Detected by Malwarebytes as Trojan.Agent.E. Note - this entry loads from the Windows Startup folder and the file is located in %ProgramFiles%\Windows NT\Accessories\Microsoft

Detected by McAfee as RDN/Generic.dx!b2g and by Malwarebytes as Trojan.Downloader.OCX

Detected by Sophos as Troj/Mdrop-DFQ and by Malwarebytes as Backdoor.Agent

Detected by McAfee as Downloader.a!crn and by Malwarebytes as Trojan.Agent

Detected by Dr.Web as Trojan.PWS.Bancos.4285 and by Malwarebytes as Trojan.Banker.E

Detected by McAfee as RDN/Generic BackDoor and by Malwarebytes as Backdoor.Agent.DCE

Detected by Dr.Web as Trojan.DownLoader10.15543 and by Malwarebytes as Trojan.Downloader.E

Detected by Malwarebytes as Trojan.Agent.AI. The file is located in %CommonFiles%\AppleDev0

Detected by Malwarebytes as Trojan.Agent.E. The file is located in %MyDocuments%

Detected by Malwarebytes as Backdoor.Agent.E. The file is located in %UserTemp%\Skyp

Detected by Sophos as Troj/FakeAV-DGF

Detected by Malwarebytes as Trojan.Agent.AB. The file is located in %Windir%

Detected by Sophos as Troj/Agent-AMFO and by Malwarebytes as Trojan.Banker.MS

Detected by Total Defense as Win32.Tactslay.A and by Malwarebytes as Trojan.Agent. The filename has a upper case "i" in it and is located in %Windir%

Detected by Symantec as W32.HLLW.Gaobot.BV. Note the different filename to the valid MS Office entries

Detected by Malwarebytes as Trojan.Agent.E. Note - the legitimate Windows Explorer (same filename) is located in %Windir%. This one is located in %AppData%\Windows