Detected by Sophos as Troj/Qoolaid-R

Detected by Symantec as Trojan.Lodelit and by Malwarebytes as Trojan.FakeAlert

Detected by Malwarebytes as Ransom.FileCryptor. The file is located in %Temp%

Detected by Malwarebytes as Spyware.Password. The file is located in %UserProfile%\Desktop

Detected by Malwarebytes as Spyware.OnlineGames.E. The file is located in %ProgramFiles%\[random] - see examples here and here

Detected by Microsoft as Virus:Win32/Ursnif and by Malwarebytes as Trojan.InfoStealer.WSPGen. The file is located in %AppData%\[random]

Detected by Dr.Web as Win32.HLLW.Autoruner1.16472 and by Malwarebytes as Trojan.Agent

Detected by Malwarebytes as Trojan.Agent.WUE. The file is located in %CommonAppData%\Windows Update Engine

Detected by Malwarebytes as Backdoor.Bot. The file is located in %CommonAppData%\Windows Font Preloader Service

Detected by Malwarebytes as Ransom.TeslaCrypt. The file is located in %AppData%

Detected as Nurech. The file is located in %System%

Detected by Sophos as Troj/Vidlo-P

Detected by Trend Micro as WORM_RBOT.XG

Detected by Sophos as Troj/Agent-GBO and by Malwarebytes as Trojan.Agent.WSV. The file is located in %Windir%

Detected by Sophos as Troj/VB-DXP. The most common filename is "winshow.exe", which is located in %Windir%

Detected by Symantec as Trojan.Adwareloader

Detected by Malwarebytes as Trojan.Banker. The file is located in %CommonAppData%\QuickTime

Detected by Sophos as W32/Lerpa-A. Note - the file name will be one of the following common.exe, common.pif, common.scr, Sexo.exe, Sexo.jpg.pif, ini_file__.pif, load_me__.tmp, msfile.pif, system_load_.pif or zipped.rar.pif

Detected by Malwarebytes as Trojan.Agent. The file is located in %AppData%