Trojan.Encoder.29230

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\v421e-readme.txt
%HOMEPATH%\start menu\programs\startup\v421e-readme.txt

Creates the following files on removable media

<Drive name for removable media>:\v421e-readme.txt
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

C:\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\de\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\el\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\en\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\es\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sk\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fi\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\he\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hi\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hu\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\id\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\bg\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fil\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lt\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\da\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\cs\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ca\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ar\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pl\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_br\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_pt\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ro\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\it\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ru\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sl\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ja\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sr\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\th\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\tr\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\uk\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\vi\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lv\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_cn\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_tw\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sv\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nl\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lt\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\no\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\cs\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\da\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\de\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\el\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\en\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_tw\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\es\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fil\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fr\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hi\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hr\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hu\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\id\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ar\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fi\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ca\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\bg\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_cn\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pl\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_br\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_pt\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ro\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ko\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lv\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ru\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\nl\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\th\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\tr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\uk\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\vi\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sk\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sl\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\tw\lc_messages\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sv\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nb\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ko\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ja\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mr\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ms\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mt\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\my\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\nb\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ru\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ne\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\nn\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\oc\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\pl\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\pt\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\lv\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\lt\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\nl\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mo\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ml\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ku\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ko\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\he\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\hi\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\hr\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\hu\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ro\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\id\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\it\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mk\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ja\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ka\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\kab\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\kk\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\kn\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\is\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\gl\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fy\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\jv\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\shn\lc_messages\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\cs\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sq\lc_messages\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\el\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en_gb\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ca\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sk\lc_messages\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es_419\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\de\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fil\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hi\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hr\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hu\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\id\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\et\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fi\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\it\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fr\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fr\lc_messages\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\da\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\bg\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sr\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sv\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ta\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\te\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\th\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\tr\lc_messages\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\it\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ug\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ur\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\uz\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\vi\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\wae\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sl\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\uk\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\gu\lc_messages\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ja\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\no\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\tr\v421e-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\v421e-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\v421e-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\branding\v421e-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\browser-region\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lv\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\msg\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\util\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\common\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\win32\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\win32\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ar\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\bg\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sr\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\pkt\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\th\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sv\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sl\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sk\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hu\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\id\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\it\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ja\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ko\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ca\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lt\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\he\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ms\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\no\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pl\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_br\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_pt\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ro\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hi\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ru\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\nl\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\cs\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\en\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ro\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ru\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sk\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sl\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sv\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\no\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\th\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\uk\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\vi\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_cn\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_tw\v421e-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\branding\v421e-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\browser-region\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_br\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_pt\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pl\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\nl\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fil\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\es\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fi\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fil\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\he\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\da\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\el\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\de\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hi\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\it\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ja\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ko\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lt\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lv\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hr\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hu\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\id\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fr\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fi\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fi\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\da\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\de\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\el\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_gb\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hi\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_us\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es_419\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\et\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fi\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fil\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fr\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ar\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\_locales\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\cs\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ca\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_tw\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_cn\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pl\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_br\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_pt\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ro\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\he\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ru\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sk\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hr\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sl\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\th\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\tr\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\uk\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\vi\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\se\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\nl\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lv\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sr\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hu\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\vi\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\it\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_tw\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ar\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\bg\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ca\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\cs\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\uk\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\tr\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_cn\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\da\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_us\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es_419\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\et\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\eu\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\de\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\el\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_gb\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lt\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ko\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\bg\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ja\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ko\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lt\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lv\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\nl\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\th\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\id\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sv\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\no\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ro\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ru\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sk\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sl\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sr\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pl\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_br\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_pt\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fi\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fa\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\eu\lc_messages\v421e-readme.txt
%TEMP%\lilo.1120\v421e-readme.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\v421e-readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\v421e-readme.txt
%TEMP%\opera installer\v421e-readme.txt
%TEMP%\outlook logging\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\google chrome\v421e-readme.txt
%TEMP%\pyl1.tmp\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\v421e-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\v421e-readme.txt
%TEMP%\adobe_admlogs\v421e-readme.txt
%TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\v421e-readme.txt
%TEMP%\hsperfdata_user\v421e-readme.txt
%TEMP%\history\v421e-readme.txt
%TEMP%\2.9.0.1467 (partner)\v421e-readme.txt
%HOMEPATH%\favorites\links\яндекс.url
%ALLUSERSPROFILE%\start menu\programs\qip 2012\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\steam\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\winrar\v421e-readme.txt
C:\documents and settings\default user\local settings\history\history.ie5\v421e-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\v421e-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\v421e-readme.txt
C:\documents and settings\default user\start menu\programs\startup\v421e-readme.txt
%TEMP%\<INETFILES>\v421e-readme.txt
C:\documents and settings\localservice\local settings\history\history.ie5\v421e-readme.txt
C:\documents and settings\networkservice\local settings\history\history.ie5\v421e-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\v421e-readme.txt
%HOMEPATH%\local settings\history\history.ie5\v421e-readme.txt
%HOMEPATH%\favorites\links\почта.url
C:\documents and settings\default user\start menu\programs\accessories\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\v421e-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\mirc\v421e-readme.txt
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\v421e-readme.txt
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\v421e-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\v421e-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\v421e-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\v421e-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\v421e-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\v421e-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\v421e-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\h8mbgrq8\v421e-readme.txt
%HOMEPATH%\local settings\history\history.ie5\mshist012017042620170427\v421e-readme.txt
%TEMP%\history\history.ie5\v421e-readme.txt
%TEMP%\pyl1.tmp\bin\v421e-readme.txt
%TEMP%\pyl1.tmp\data\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\v421e-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\entertainment\v421e-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\accessibility\v421e-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\v421e-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\z9pmdpek\v421e-readme.txt
%TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\v421e-readme.txt
%HOMEPATH%\start menu\programs\accessories\v421e-readme.txt
%HOMEPATH%\start menu\programs\administrative tools\v421e-readme.txt
%HOMEPATH%\start menu\programs\icq\v421e-readme.txt
%HOMEPATH%\start menu\programs\telegram desktop\v421e-readme.txt
%TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\v421e-readme.txt
%HOMEPATH%\start menu\programs\winrar\v421e-readme.txt
%TEMP%\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\v421e-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\system tools\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\v421e-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ee7gwdg8\v421e-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\etuaii8e\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\games\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\communications\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\administrative tools\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\v421e-readme.txt
C:\documents and settings\default user\my documents\v421e-readme.txt
C:\documents and settings\default user\recent\v421e-readme.txt
C:\documents and settings\default user\sendto\v421e-readme.txt
C:\documents and settings\default user\start menu\v421e-readme.txt
C:\documents and settings\default user\templates\v421e-readme.txt
C:\documents and settings\localservice\cookies\v421e-readme.txt
C:\documents and settings\localservice\local settings\v421e-readme.txt
%HOMEPATH%\nethood\v421e-readme.txt
C:\documents and settings\networkservice\cookies\v421e-readme.txt
%HOMEPATH%\.oracle_jre_usage\v421e-readme.txt
%HOMEPATH%\cookies\v421e-readme.txt
%HOMEPATH%\desktop\v421e-readme.txt
%HOMEPATH%\favorites\v421e-readme.txt
C:\documents and settings\default user\local settings\v421e-readme.txt
C:\documents and settings\default user\favorites\v421e-readme.txt
C:\documents and settings\default user\desktop\v421e-readme.txt
C:\documents and settings\default user\printhood\v421e-readme.txt
C:\documents and settings\default user\cookies\v421e-readme.txt
C:\documents and settings\v421e-readme.txt
%ProgramFiles%\v421e-readme.txt
C:\recycler\v421e-readme.txt
%ALLUSERSPROFILE%\v421e-readme.txt
C:\documents and settings\default user\v421e-readme.txt
C:\documents and settings\localservice\v421e-readme.txt
%HOMEPATH%\local settings\v421e-readme.txt
C:\documents and settings\networkservice\v421e-readme.txt
C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\v421e-readme.txt
C:\documents and settings\networkservice\local settings\v421e-readme.txt
%ALLUSERSPROFILE%\desktop\v421e-readme.txt
%ALLUSERSPROFILE%\drm\v421e-readme.txt
%ALLUSERSPROFILE%\favorites\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\v421e-readme.txt
%ALLUSERSPROFILE%\templates\v421e-readme.txt
%HOMEPATH%\v421e-readme.txt
%HOMEPATH%\my documents\v421e-readme.txt
<Current directory>\v421e-readme.txt
%ALLUSERSPROFILE%\documents\v421e-readme.txt
C:\documents and settings\default user\nethood\v421e-readme.txt
%HOMEPATH%\printhood\v421e-readme.txt
%HOMEPATH%\local settings\history\v421e-readme.txt
%HOMEPATH%\local settings\<INETFILES>\v421e-readme.txt
%HOMEPATH%\my documents\downloads\v421e-readme.txt
%HOMEPATH%\my documents\my music\v421e-readme.txt
%HOMEPATH%\my documents\my pictures\v421e-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\v421e-readme.txt
%HOMEPATH%\start menu\programs\v421e-readme.txt
%HOMEPATH%\favorites\links\v421e-readme.txt
%TEMP%\v421e-readme.txt
%HOMEPATH%\userdata\e3unqlkn\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my music\my playlists\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample music\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\v421e-readme.txt
%HOMEPATH%\userdata\09upir0l\v421e-readme.txt
%TEMP%\pyl1.tmp\winboot\v421e-readme.txt
%HOMEPATH%\userdata\inafedwn\v421e-readme.txt
%HOMEPATH%\userdata\ubghkdcj\v421e-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\v421e-readme.txt
C:\documents and settings\networkservice\local settings\temp\v421e-readme.txt
%HOMEPATH%\recent\v421e-readme.txt
%HOMEPATH%\start menu\v421e-readme.txt
%HOMEPATH%\templates\v421e-readme.txt
%HOMEPATH%\userdata\v421e-readme.txt
%HOMEPATH%\voip\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my music\v421e-readme.txt
C:\documents and settings\networkservice\local settings\history\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my pictures\v421e-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\v421e-readme.txt
%ALLUSERSPROFILE%\start menu\programs\v421e-readme.txt
C:\documents and settings\default user\local settings\temp\v421e-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\v421e-readme.txt
C:\documents and settings\default user\start menu\programs\v421e-readme.txt
C:\documents and settings\localservice\local settings\history\v421e-readme.txt
C:\documents and settings\localservice\local settings\temp\v421e-readme.txt
%ALLUSERSPROFILE%\documents\my videos\v421e-readme.txt
%HOMEPATH%\sendto\v421e-readme.txt
C:\documents and settings\default user\local settings\history\v421e-readme.txt
%TEMP%\cookies\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ur\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\wae\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\v421e-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\v421e-readme.txt
%TEMP%\<INETFILES>\content.ie5\4xoboj8j\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\v421e-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\uk\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ug\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\vi\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\uz\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\tw\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\tr\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\pt\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ro\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ru\v421e-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\shn\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sl\v421e-readme.txt
%TEMP%\<INETFILES>\content.ie5\chyzclen\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sq\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sv\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ta\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\te\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\th\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sk\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\oc\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\nn\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\sr\v421e-readme.txt
%TEMP%\<INETFILES>\content.ie5\g1qjk5mv\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\bs\lc_messages\v421e-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\crh\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\cs\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\csb\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\cy\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\da\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\br\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\bo\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ca\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\de\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\eo\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\es\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\et\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\el\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en_au\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\pl\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\nl\v421e-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\v421e-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\hooks\v421e-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\packages\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\cipher\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\hash\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\publickey\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\bg\lc_messages\v421e-readme.txt
%TEMP%\<INETFILES>\content.ie5\ibwpozo7\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ast\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\util\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\xml\parsers\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\xml\sax\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\af\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ar\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\as\lc_messages\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\v421e-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\tr\v421e-readme.txt
D:\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\my\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\af\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ar\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\as\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ast\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\bg\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\bo\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\de\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\br\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ca\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\crh\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\cs\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\csb\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\cy\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\winui\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\urlgrabber\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\xml\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\sets\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\v421e-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\v421e-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\v421e-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\v421e-readme.txt
%TEMP%\<INETFILES>\content.ie5\v421e-readme.txt
%HOMEPATH%\start menu\programs\accessories\accessibility\v421e-readme.txt
%HOMEPATH%\start menu\programs\accessories\entertainment\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\da\v421e-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\bs\v421e-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\bittorrent\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\ctypes\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\encodings\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\logging\v421e-readme.txt
%TEMP%\pyl1.tmp\bin\formats\v421e-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\v421e-readme.txt
%TEMP%\pyl1.tmp\data\images\v421e-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\el\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ja\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ka\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\kab\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\kk\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\kn\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ko\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\it\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\jv\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ku\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ml\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mo\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mr\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ms\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mt\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\lt\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\lv\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\mk\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\ne\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\nb\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\hu\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\eo\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\es\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\et\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\eu\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\id\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\is\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fa\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fy\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\gl\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\gu\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\he\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\hi\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\hr\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\en_au\v421e-readme.txt
%TEMP%\pyl1.tmp\translations\fr\v421e-readme.txt
%TEMP%\6un27m2kw.bmp

Moves the following files

from %HOMEPATH%\favorites\links\почта.url to %HOMEPATH%\favorites\links\почта.url.v421e
from %TEMP%\dd_vcredist_x86_20151215221751.log to %TEMP%\dd_vcredist_x86_20151215221751.log.v421e
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.v421e
from %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log.v421e
from %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log.v421e
from %TEMP%\dd_xps.txt to %TEMP%\dd_xps.txt.v421e
from %TEMP%\java_install.log to %TEMP%\java_install.log.v421e
from %TEMP%\dd_depcheck_netfx20_exp_35.txt to %TEMP%\dd_depcheck_netfx20_exp_35.txt.v421e
from %TEMP%\java_install_reg.log to %TEMP%\java_install_reg.log.v421e
from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\dd_net_framework30_setup7762.txt.v421e
from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\dd_net_framework35_msi77c4.txt.v421e
from %TEMP%\dd_net_framework20_setup74f9.txt to %TEMP%\dd_net_framework20_setup74f9.txt.v421e
from %TEMP%\setupexe(201511201342324e4).log to %TEMP%\setupexe(201511201342324e4).log.v421e
from %TEMP%\setupexe(20151215230521214).log to %TEMP%\setupexe(20151215230521214).log.v421e
from %TEMP%\setupexe(2015121523093290).log to %TEMP%\setupexe(2015121523093290).log.v421e
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.v421e
from %TEMP%\jaureg.log to %TEMP%\jaureg.log.v421e
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.v421e
from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd_wcf_retca4a2a.txt.v421e
from %TEMP%\dd_dotnetfx35install.txt to %TEMP%\dd_dotnetfx35install.txt.v421e
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.v421e
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.v421e
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.v421e
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.v421e
from %TEMP%\aucheck_parser.txt to %TEMP%\aucheck_parser.txt.v421e
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.v421e
from %TEMP%\uxeventlog.txt to %TEMP%\uxeventlog.txt.v421e
from %TEMP%\jusched.log to %TEMP%\jusched.log.v421e
from %TEMP%\dd_clwireg.txt to %TEMP%\dd_clwireg.txt.v421e
from %TEMP%\dd_depcheck_netfx_exp_35.txt to %TEMP%\dd_depcheck_netfx_exp_35.txt.v421e
from %TEMP%\dd_dotnetfx35error.txt to %TEMP%\dd_dotnetfx35error.txt.v421e
from %TEMP%\dd_dotnetfx20install.txt to %TEMP%\dd_dotnetfx20install.txt.v421e
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.v421e
from %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt to %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.v421e
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.v421e
from %HOMEPATH%\favorites\links\яндекс.url to %HOMEPATH%\favorites\links\яндекс.url.v421e
from %TEMP%\dd_dotnetfx20error.txt to %TEMP%\dd_dotnetfx20error.txt.v421e
from %TEMP%\wubi-14.04-rev286.log to %TEMP%\wubi-14.04-rev286.log.v421e

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'11.#n.ua':443
'gu##edd.com':443
'ac###ruppe.ch':443
'sw##tz.fr':443
'mo##de.nl':443
'ri####katjaya.com':443
'mg###lta.com':443
'ba###olics.in':443
'ai#####blishing.co.uk':443
'ai#####iceunlimited.com':443
'bu########r-butzbach-werbemittel.de':443
'ac#####mmobil.com.tr':443
'un####w-narty.pl':443
'pa###school.ru':443
'th####e-embellie.fr':443
'zi##ak.com':443
'is####idigitali.com':443
'eg#u.fr':443
'mi####lfiegel.com':443
'ph####xcrane.com':443
'br###.online':443
'sl###events.be':443
'or#####brickwork.com':443
'mn##i.ru':443
'tr###ifer.fr':443
'vv##o.com':443
'ak####-safaris.com':443
'ao##ma.ac':443
're######ephotography.com':443
'am##.net.au':443
'rv##de.com':443
'ja#########-and-projectmanagement.com':443
'or##eb.net':443
'br#####rnfastigheter.se':443
'sa####oncrete.com':443
'si####edenroth.dk':443
'sp##ebel.be':443
'ij###lbeton.nl':443
't3###thers.com':443
'dr####oiceclub.org':443
'ro###lyn.com':443
'mo#####carthydesign.com':443
'de##plan.ru':443
'rt##4.com':443
'ni##aki.com':443
'pi###elook.com':443
'ci#####-diagramz.com':443
'co#####eneuracademy.com':443
'si###media.de':443
'fr####yballs.com':443

TCP

HTTP GET requests

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt

UDP

DNS ASK se####s-clubs.co.uk
DNS ASK sl###events.be
DNS ASK te####ebell.website
DNS ASK or#####brickwork.com
DNS ASK gu##edd.com
DNS ASK ac###ruppe.ch
DNS ASK sw##tz.fr
DNS ASK mo##de.nl
DNS ASK ri####katjaya.com
DNS ASK mg###lta.com
DNS ASK ba###olics.in
DNS ASK tr###ifer.fr
DNS ASK mn##i.ru
DNS ASK ai#####blishing.co.uk
DNS ASK sp##ebel.be
DNS ASK un####w-narty.pl
DNS ASK pa###school.ru
DNS ASK th####e-embellie.fr
DNS ASK zi##ak.com
DNS ASK is####idigitali.com
DNS ASK eg#u.fr
DNS ASK mi####lfiegel.com
DNS ASK ph####xcrane.com
DNS ASK br###.online
DNS ASK ai#####iceunlimited.com
DNS ASK ac#####mmobil.com.tr
DNS ASK vv##o.com
DNS ASK ci#####-diagramz.com
DNS ASK pi###elook.com
DNS ASK dc##eu.com
DNS ASK go####yscustom.com
DNS ASK 11.#n.ua
DNS ASK co#####eneuracademy.com
DNS ASK ak####-safaris.com
DNS ASK ao##ma.ac
DNS ASK re######ephotography.com
DNS ASK ls###oupe.com
DNS ASK am##.net.au
DNS ASK rv##de.com
DNS ASK ja#########-and-projectmanagement.com
DNS ASK la#####ithleslie.com
DNS ASK or##eb.net
DNS ASK sa####oncrete.com
DNS ASK ij###lbeton.nl
DNS ASK bu########r-butzbach-werbemittel.de
DNS ASK si###media.de
DNS ASK t3###thers.com
DNS ASK dr####oiceclub.org
DNS ASK ro###lyn.com
DNS ASK mo#####carthydesign.com
DNS ASK de##plan.ru
DNS ASK rt##4.com
DNS ASK ni##aki.com
DNS ASK br#####rnfastigheter.se
DNS ASK si####edenroth.dk
DNS ASK fr####yballs.com

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial