Trojan.Encoder.39043

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\!!read_me!!.txt

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\net.exe' stop MSSQLSERVER /f /m
'<SYSTEM32>\net.exe' stop SQLSERVERAGENT /f /m
'<SYSTEM32>\net.exe' stop MSSQLFDLauncher /f /m

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe

the following user processes:

iexplore.exe
firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\weeklysheet1215.doc
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\office\groove\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\office\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\burn\burn\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\burn\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\caches\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\explorer\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\gameexplorer\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\history\low\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\history\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\virtualized\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\wer\erc\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportarchive\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0fbabd8f\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\office\groove\user\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\ringtones\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\office\groove\system\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\swiftshader\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\widevinecdm\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\!!read_me!!.txt
%LOCALAPPDATA%\google\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\credentials\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\feeds cache\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\internet explorer\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\media player\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\!!read_me!!.txt
%LOCALAPPDATA%low\mozilla\temp-{3571406e-c08c-4c74-b145-8857b365f6e7}\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\!!read_me!!.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\!!read_me!!.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\!!read_me!!.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\!!read_me!!.txt
%TEMP%\opera installer\!!read_me!!.txt
%TEMP%\wpdnse\!!read_me!!.txt
%TEMP%\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\doomed\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\google4\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\hmz1jddi.default\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\!!read_me!!.txt
%LOCALAPPDATA%\!!read_me!!.txt
%LOCALAPPDATA%low\microsoft\internet explorer\services\!!read_me!!.txt
%LOCALAPPDATA%low\microsoft\internet explorer\!!read_me!!.txt
%LOCALAPPDATA%low\microsoft\!!read_me!!.txt
%LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\!!read_me!!.txt
%LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\!!read_me!!.txt
%TEMP%\low\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\pnacl\!!read_me!!.txt
%TEMP%\hsperfdata_user\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\doomed\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows mail\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows media\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows sidebar\gadgets\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows sidebar\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\!!read_me!!.txt
%LOCALAPPDATA%\microsoft help\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\m15ucxjx.default\!!read_me!!.txt
%LOCALAPPDATA%\microsoft\windows\wer\!!read_me!!.txt
%LOCALAPPDATA%\programs\common\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\safebrowsing\google4\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\safebrowsing\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\thumbnails\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\firefox\!!read_me!!.txt
%LOCALAPPDATA%\mozilla\!!read_me!!.txt
%LOCALAPPDATA%\programs\!!read_me!!.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\pepperflash\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\vi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_cn\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_tw\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\_locales\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\session storage\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\evwhitelist\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\!!read_me!!.txt
<Current directory>\!!read_me!!.txt
%LOCALAPPDATA%low\oracle\java\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\minidumps\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\events\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\maintenance\!!read_me!!.txt
%APPDATA%\microsoft\windows\privacie\!!read_me!!.txt
%APPDATA%\microsoft\windows\recent\automaticdestinations\!!read_me!!.txt
%APPDATA%\microsoft\windows\recent\customdestinations\!!read_me!!.txt
%APPDATA%\microsoft\windows\recent\!!read_me!!.txt
%APPDATA%\microsoft\windows\sendto\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\google chrome\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\!!read_me!!.txt
%APPDATA%\mozilla\firefox\pending pings\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\winrar\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\programs\!!read_me!!.txt
%APPDATA%\microsoft\windows\start menu\!!read_me!!.txt
%APPDATA%\microsoft\windows\templates\!!read_me!!.txt
%APPDATA%\microsoft\windows\themes\!!read_me!!.txt
%APPDATA%\microsoft\windows\!!read_me!!.txt
%APPDATA%\microsoft\!!read_me!!.txt
%APPDATA%\mozilla\extensions\!!read_me!!.txt
%APPDATA%\mozilla\firefox\crash reports\events\!!read_me!!.txt
%APPDATA%\mozilla\firefox\crash reports\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\!!read_me!!.txt
%LOCALAPPDATA%low\oracle\java\au\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\!!read_me!!.txt
%APPDATA%\thunderbird\!!read_me!!.txt
%APPDATA%\!!read_me!!.txt
%HOMEPATH%\appdata\!!read_me!!.txt
%HOMEPATH%\contacts\!!read_me!!.txt
%HOMEPATH%\desktop\!!read_me!!.txt
%HOMEPATH%\documents\!!read_me!!.txt
%HOMEPATH%\downloads\!!read_me!!.txt
%HOMEPATH%\favorites\links\!!read_me!!.txt
%HOMEPATH%\favorites\links for united states\!!read_me!!.txt
%HOMEPATH%\favorites\msn websites\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\!!read_me!!.txt
%HOMEPATH%\favorites\windows live\!!read_me!!.txt
%HOMEPATH%\favorites\!!read_me!!.txt
%HOMEPATH%\links\!!read_me!!.txt
%HOMEPATH%\music\!!read_me!!.txt
%HOMEPATH%\pictures\!!read_me!!.txt
%HOMEPATH%\saved games\!!read_me!!.txt
%HOMEPATH%\searches\!!read_me!!.txt
%HOMEPATH%\videos\!!read_me!!.txt
%HOMEPATH%\!!read_me!!.txt
C:\users\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\hmz1jddi.default\!!read_me!!.txt
%APPDATA%\microsoft\windows\privacie\low\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\!!read_me!!.txt
%APPDATA%\mozilla\firefox\!!read_me!!.txt
%APPDATA%\mozilla\systemextensionsdev\!!read_me!!.txt
%APPDATA%\mozilla\!!read_me!!.txt
%APPDATA%\telegram desktop\!!read_me!!.txt
%APPDATA%\thunderbird\crash reports\events\!!read_me!!.txt
%APPDATA%\thunderbird\crash reports\!!read_me!!.txt
%APPDATA%\thunderbird\pending pings\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\events\!!read_me!!.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\minidumps\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\default\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\!!read_me!!.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\uk\!!read_me!!.txt
%APPDATA%\microsoft\windows\printer shortcuts\!!read_me!!.txt
%APPDATA%\microsoft\protect\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\!!read_me!!.txt
%LOCALAPPDATA%low\oracle\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\!!read_me!!.txt
%LOCALAPPDATA%low\mozilla\!!read_me!!.txt
%APPDATA%\microsoft\windows\libraries\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\!!read_me!!.txt
%APPDATA%\microsoft\credentials\!!read_me!!.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\!!read_me!!.txt
%APPDATA%\microsoft\crypto\rsa\!!read_me!!.txt
%APPDATA%\microsoft\crypto\!!read_me!!.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\!!read_me!!.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\!!read_me!!.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\!!read_me!!.txt
%APPDATA%\microsoft\internet explorer\quick launch\!!read_me!!.txt
%APPDATA%\microsoft\internet explorer\!!read_me!!.txt
%APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\!!read_me!!.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\!!read_me!!.txt
%APPDATA%\microsoft\systemcertificates\my\crls\!!read_me!!.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\!!read_me!!.txt
%APPDATA%\microsoft\systemcertificates\my\!!read_me!!.txt
%APPDATA%\microsoft\systemcertificates\!!read_me!!.txt
%APPDATA%\microsoft\windows\cookies\low\!!read_me!!.txt
%APPDATA%\microsoft\windows\cookies\!!read_me!!.txt
%APPDATA%\microsoft\windows\iecompatcache\low\!!read_me!!.txt
%APPDATA%\microsoft\windows\iecompatcache\!!read_me!!.txt
%APPDATA%\microsoft\windows\ietldcache\low\!!read_me!!.txt
%APPDATA%\microsoft\windows\ietldcache\!!read_me!!.txt
%APPDATA%\media center programs\!!read_me!!.txt
%APPDATA%\microsoft\windows\network shortcuts\!!read_me!!.txt
%APPDATA%\identities\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\!!read_me!!.txt
%LOCALAPPDATA%low\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\security\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\deployment\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\!!read_me!!.txt
%LOCALAPPDATA%low\sun\java\!!read_me!!.txt
%LOCALAPPDATA%low\sun\!!read_me!!.txt
%APPDATA%\identities\{1bc91121-7903-48ee-bf78-1bc7ca4b5761}\!!read_me!!.txt
%HOMEPATH%\favorites\microsoft websites\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\tr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lt\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_02612a57\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\templates\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportarchive\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_cab_02612a66\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0765adcf\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\wpd\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\!!read_me!!.txt
%ALLUSERSPROFILE%\oracle\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft help\!!read_me!!.txt
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\!!read_me!!.txt
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\!!read_me!!.txt
%ALLUSERSPROFILE%\mozilla\updates\!!read_me!!.txt
%ALLUSERSPROFILE%\mozilla\!!read_me!!.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\!!read_me!!.txt
%ALLUSERSPROFILE%\oracle\java\javapath\!!read_me!!.txt
%ALLUSERSPROFILE%\oracle\java\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\upload\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\!!read_me!!.txt
C:\perflogs\!!read_me!!.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\!!read_me!!.txt
%ALLUSERSPROFILE%\adobe\setup\!!read_me!!.txt
%ALLUSERSPROFILE%\adobe\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\assistance\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\crypto\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\!!read_me!!.txt
C:\perflogs\admin\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\!!read_me!!.txt
C:\msocache\!!read_me!!.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\$recycle.bin\!!read_me!!.txt
C:\kms\!!read_me!!.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\!!read_me!!.txt
D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\!!read_me!!.txt
D:\$recycle.bin\!!read_me!!.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
D:\!!read_me!!.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\!!read_me!!.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\!!read_me!!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\!!read_me!!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\!!read_me!!.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\!!read_me!!.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\!!read_me!!.txt
C:\msocache\all users\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\manifest\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\drm\server\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\devicesync\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\vault\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\ait\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\caches\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\drm\cache\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\drm\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\gameexplorer\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\power efficiency diagnostics\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\ringtones\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\sessions\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\network\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\drm\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\ehome\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\media player\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\mf\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\msdn\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\network\connections\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\device stage\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\config\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\office\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\rac\!!read_me!!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\!!read_me!!.txt
C:\users\public\pictures\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sv\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fil\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\he\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hu\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\id\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\it\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ja\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ko\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\nl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\no\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_br\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_pt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ro\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ru\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\es\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\el\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ar\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\bg\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ca\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\cs\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\da\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\de\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\en\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\th\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\!!read_me!!.txt
C:\users\default\appdata\roaming\media center programs\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\cookies\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\recent\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\!!read_me!!.txt
C:\users\default\favorites\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\templates\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\!!read_me!!.txt
C:\users\default\appdata\roaming\!!read_me!!.txt
C:\users\default\appdata\!!read_me!!.txt
C:\users\default\desktop\!!read_me!!.txt
C:\users\default\documents\!!read_me!!.txt
C:\users\default\downloads\!!read_me!!.txt
C:\users\default\appdata\local\!!read_me!!.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\!!read_me!!.txt
C:\users\default\appdata\local\temp\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\!!read_me!!.txt
C:\users\default\appdata\local\microsoft\windows\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\!!read_me!!.txt
%ALLUSERSPROFILE%\sun\java\java update\!!read_me!!.txt
%ALLUSERSPROFILE%\sun\java\!!read_me!!.txt
%ALLUSERSPROFILE%\sun\!!read_me!!.txt
%ALLUSERSPROFILE%\!!read_me!!.txt
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\!!read_me!!.txt
C:\recovery\!!read_me!!.txt
C:\users\default\appdata\local\microsoft\windows\gameexplorer\!!read_me!!.txt
C:\users\default\appdata\local\microsoft\windows\history\!!read_me!!.txt
C:\users\default\appdata\local\microsoft\windows\<INETFILES>\!!read_me!!.txt
C:\users\default\appdata\local\microsoft\!!read_me!!.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\!!read_me!!.txt
C:\users\default\pictures\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\__macosx\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\!!read_me!!.txt
C:\users\default\music\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\caps\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\!!read_me!!.txt
C:\users\public\pictures\sample pictures\!!read_me!!.txt
C:\users\default\saved games\!!read_me!!.txt
C:\users\default\videos\!!read_me!!.txt
C:\users\default\!!read_me!!.txt
C:\users\public\desktop\!!read_me!!.txt
C:\users\public\documents\!!read_me!!.txt
C:\users\public\downloads\!!read_me!!.txt
C:\users\public\favorites\!!read_me!!.txt
C:\users\public\libraries\!!read_me!!.txt
C:\users\public\music\sample music\!!read_me!!.txt
C:\users\public\music\!!read_me!!.txt
C:\users\default\links\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\!!read_me!!.txt
C:\users\public\recorded tv\sample media\!!read_me!!.txt
C:\users\public\recorded tv\!!read_me!!.txt
C:\users\public\videos\sample videos\!!read_me!!.txt
C:\users\public\videos\!!read_me!!.txt
C:\users\public\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\!!read_me!!.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\!!read_me!!.txt
C:\!!read_me!!.txt

Deletes the following files

%TEMP%\wpdnse\!!read_me!!.txt

Modifies the following files

C:\kms\kms_vl_all_aio_debug.log
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\340a10d652987df5e54312e31f5c22f6e8dba574
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\2b8fb3a7c1e8990ce64886d66718692d2b2ed2bc
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\1e9395fbb58031ece972bfe7a83eb202a6f3ea4f
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\1d31e5bc1d43a3825d47266c8691ca41cc23fe01
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\1d048d4c93ba7775f1c2e11f1117d0fde4760f65
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\13a9d78e63abd60764cbeb0bbd193b7b831d4c13
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\favicon[1].ico
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db
%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\{49e6f824-13e9-11ef-9b07-dcfd92cc583f}.dat
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\recoverystore.{49e6f823-13e9-11ef-9b07-dcfd92cc583f}.dat
%LOCALAPPDATA%\microsoft\feeds cache\index.dat
%ALLUSERSPROFILE%\microsoft\windows defender\support\mplog-07132009-221054.log
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.edb
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010007.wid
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010007.dir
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010007.ci
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.log
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.chk
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.2.gthr
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.2.crwl
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.dat
D:\install.log
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\464a8f35763cce65f46682c0338f02b065356c62

Modifies multiple files.

Substitutes the following files

%TEMP%\wpdnse\!!read_me!!.txt

Modifies user data files (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'Media Center Tray Applet' WindowName: ''
ClassName: '' WindowName: 'View Available Networks'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v MaxDisconnectionTime /t REG_DWORD /d 1209600000 /f
'<SYSTEM32>\net1.exe' stop MSSQLSERVER /f /m
'<SYSTEM32>\net1.exe' stop SQLSERVERAGENT /f /m
'<SYSTEM32>\net1.exe' stop MSSQLFDLauncher /f /m
'%WINDIR%\explorer.exe'
'<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v MaxDisconnectionTime /t REG_DWORD /d 1209600000 /f' (with hidden window)
'<SYSTEM32>\net.exe' stop MSSQLSERVER /f /m' (with hidden window)
'<SYSTEM32>\net.exe' stop SQLSERVERAGENT /f /m' (with hidden window)
'<SYSTEM32>\net.exe' stop MSSQLFDLauncher /f /m' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial