Trojan.Encoder.29222

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\net.exe' stop "audioendpointbuilder" /y
'<SYSTEM32>\net.exe' stop "samss" /y

Modifies file system

Creates the following files

%PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_597d9903-ea81-40e6-803a-40d3e5258fa4
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\56\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\55\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\54\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\53\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\52\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\51\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\50\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\5\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\49\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\48\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\47\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\46\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\45\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\44\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\43\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\42\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\41\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\40\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\4\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\39\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\38\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\37\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\36\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\57\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\59\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\6\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211650z-145784
C:\documents and settings\user\appdata\roaming\.purple\smileys\ryukreadme.html
C:\documents and settings\user\appdata\roaming\.purple\certificates\x509\tls_peers\ryukreadme.html
C:\documents and settings\user\appdata\roaming\.purple\certificates\x509\ryukreadme.html
C:\documents and settings\user\appdata\roaming\.purple\certificates\ryukreadme.html
C:\documents and settings\user\appdata\roaming\.purple\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1daf2884ec4dfa96ba4a58d4dbc9c406
C:\documents and settings\user\appdata\roaming\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\jre1.7.0_11\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\tmp\si\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\tmp\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\security\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\muffin\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\host\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211649z-145757
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\9\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\8\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\7\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\63\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\62\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\61\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\60\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\35\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\58\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211650z-145807
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\10\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211652z-145865
C:\documents and settings\user\appdata\locallow\sun\java\deployment\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\au\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\imjp9_0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\imjp8_1\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\imjp12\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\ime12\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\nl_nl\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\en_us\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\en_gb\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\en_ca\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\de_de\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\1\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\11\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\33\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\12\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\32\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\31\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\30\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\3\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\29\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\28\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\27\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\26\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\25\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\24\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\23\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\22\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\21\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\20\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\2\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\19\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\18\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\17\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\16\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\15\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\14\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\23b523c9e7746f715d33c6527c18eb9d
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\13\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\34\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_9ec9a77366fa3db60d703f22e947149f
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\forms\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b8944ba8ad0efdf0e01a43ef62becd0_24e0d7000cefaf417bb7236f66f3cc23
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9
C:\documents and settings\user\appdata\roaming\icq-profile\update\ver.txt
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\696f3de637e6de85b458996d49d759ad
C:\documents and settings\user\appdata\roaming\.purple\prefs.xml
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_kz.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ru.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_tr.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_uz.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\segoesc.ttf
C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.aff
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b8cc409acdbf2a2fe04c56f2875b1fd6
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\collab\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b912b2c6928a18b8cd7d50cf08bea95b_f85b8279fa54a31ceec2563f5a8f73e8
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_52e1450a209543a86ce12abd07318056
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b8cc409acdbf2a2fe04c56f2875b1fd6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ua.csv
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_en.csv
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40eb206a466c1f1175ccb23e825b3250
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3130b1871a126520a8c47861efe3ed4d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\23b523c9e7746f715d33c6527c18eb9d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_9ec9a77366fa3db60d703f22e947149f
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_52e1450a209543a86ce12abd07318056
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf
C:\documents and settings\user\appdata\roaming\icq-profile\base\mra.dbs
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\de_ch\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6
C:\documents and settings\user\appdata\roaming\icqm\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\update\splash_banner\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\update\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\base\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\logtransport2\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\linguistics\dictionaries\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\linguistics\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\headlights\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6
C:\documents and settings\user\appdata\roaming\adobe\flash player\assetcache\3txfxk6a\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\flash player\assetcache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\flash player\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\featout\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\crlcache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\jscache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\forms\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\collab\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\crlcache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\javascripts\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211652z-145844
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9
C:\documents and settings\user\appdata\roaming\icqm\icq\database\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\696f3de637e6de85b458996d49d759ad
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\3130b1871a126520a8c47861efe3ed4d
C:\documents and settings\user\appdata\locallow\sun\java\jre1.7.0_11\jre1.7.0_11.msi
C:\documents and settings\user\appdata\roaming\.purple\status.xml
C:\documents and settings\user\appdata\locallow\sun\java\deployment\deployment.properties
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1daf2884ec4dfa96ba4a58d4dbc9c406
C:\documents and settings\user\appdata\locallow\sun\java\au\au.msi
C:\documents and settings\user\appdata\locallow\sun\java\au\au.cab
C:\documents and settings\user\appdata\roaming\icq-profile\installerlang.xml
C:\documents and settings\user\appdata\roaming\icq-profile\base\opt.dbs
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\tmgrpprm.sav
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\94308059b57b3142e455b38a6eb92015
C:\documents and settings\user\appdata\roaming\icqm\icq\dll\altergeo.msi
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\addressbook.acrodata
C:\documents and settings\user\appdata\locallow\sun\java\jre1.7.0_11\data1.cab
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\addressbook.acrodata
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl
C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl
C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\bing.ico
C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\tmdocs.sav
C:\documents and settings\user\appdata\roaming\icqm\icq\dll\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b8944ba8ad0efdf0e01a43ef62becd0_24e0d7000cefaf417bb7236f66f3cc23
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\all\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\4qwyjxrb\z28kevgyocyga...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db3765821...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14....
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14....
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\d4036846864773e3d647f421dfe7f6ca536e307b\p...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition updates\{ccca0d05-...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\windows\projects\syst...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-177...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\keys\514ca71677b920c425f6892a3cb118c8_5...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\83aa4cc77f591dfc2374580bbd...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be0...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\documents\my music\sample music\albumart_{5fa05d35-a682-...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netframeworksdkv1.1_1...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\mi...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{a2563e55-3bec-3828-8d67-...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\d4036846864773e3d647f421d...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netf...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\client\1.0\en-us\h...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\wind...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{e35be42d-f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{07deb856-f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a0...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x86_13a36dc09bf9d624d4142a4...
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x86_3d7e2448614bf82912853ac...
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\sendto\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\recent\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\printer shortcuts\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\network shortcuts\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\cookies\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\ryukreadme.html
C:\documents and settings\default\appdata\roaming\media center programs\ryukreadme.html
C:\documents and settings\default\appdata\roaming\ryukreadme.html
C:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\applicati...
C:\documents and settings\default\appdata\local\ryukreadme.html
C:\documents and settings\default\appdata\ryukreadme.html
C:\documents and settings\default\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeaddition...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_7.5.7601.17514_f31859bd6985621a938c6abaee046...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_e7eb2baa96a4c04831d2db486a18e3d2a26...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x86_cad546c1c8ffa475ec9e7e4...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\device\{8702d817...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_e7eb2baa96a4c04831...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\device\{113527a4...
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrupd10116.msp
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrsecupd10111.msp
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrupd10110.msp
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\arm.msi
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ab0000000001}\data1.cab
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ab0000000001}\acroread.msi
%ALLUSERSPROFILE%\adobe\acrobat\11.0\replicate\security\directories.acrodata
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ab0000000001}\ryukreadme.html
%ALLUSERSPROFILE%\adobe\setup\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\23770\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\ryukreadme.html
%ALLUSERSPROFILE%\adobe\acrobat\11.0\replicate\security\ryukreadme.html
%ALLUSERSPROFILE%\adobe\acrobat\11.0\replicate\ryukreadme.html
%ALLUSERSPROFILE%\adobe\acrobat\11.0\ryukreadme.html
%ALLUSERSPROFILE%\adobe\acrobat\ryukreadme.html
%ALLUSERSPROFILE%\adobe\ryukreadme.html
%ALLUSERSPROFILE%\ryukreadme.html
C:\documents and settings\ryukreadme.html
C:\ryukreadme.html
D:\$recycle.bin\s-1-5-21-2922372159-162323534-3872807762-1001\ryukreadme.html
D:\$recycle.bin\ryukreadme.html
D:\ryukreadme.html
%TEMP%\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adobearm.bin
%ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdr1010_en_us.msi
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\ad...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\appli...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\ac...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f0080ca...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{74d0e5d...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{6c95b50...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{615bc16...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{2af972c...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{01db25f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\d4036846...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows nt\m...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defe...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\powe...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\devi...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\user account...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\officesoftwa...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\netframework...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music\sam...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\c...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\event viewer...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\micro...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\docum...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\mi...
C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\recovery\last acti...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\apps\2.0\paxy2tl4.dk6\0l5hj4h1.d17\google.app_...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\apps\2.0\paxy2tl4.dk6\0l5hj4h1.d17\clic...exe_...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\wef9w...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\apps\2.0\data\6k5hoej1.rj7\mvp5hrz0.aq7\google...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\yuk3f...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\53q3w...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\4qwyj...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\microsoft .net framework...
volume{85074cd1-c6f4-11e6-abb6-080027131f42}\system volume information\tracking.log.tmp
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\acrord32_sbx\<INETFILES>...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\r...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\sync p...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\art ca...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feeds for uni...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\{5588acfd-643...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\thunderbird\...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\microso...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_vcre...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_ndp4...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\<INETFI...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\of...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\apps\2.0\paxy2tl4.dk6\0l5hj4h1.d17\manifests\g...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\apps\2.0\data\6k5hoej1.rj7\mvp5hrz0.aq7\google.app_86fd5b6b43e6...
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportarchive\appcrash_acrord32.exe_7f5cb...
C:\documents and settings\user\appdata\locallow\adobe\linguistics\dictionaries\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\search\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\readermessages
C:\documents and settings\user\appdata\locallow\adobe\acrobat\10.0\readermessages
C:\documents and settings\user\appdata\locallow\adobe\acrobat\10.0\rdrmessage.zip
C:\documents and settings\user\appdata\local\<INETFILES>\content.ie5\4qwyjxrb\txpumcu5db9fstga-q7irizsq-wh7dq0hjyoaywo0b0robdft2cttoikcsrir_tjk8kcaxtfke2tmhoi5dpbsycqh3njxohldzyoabn4ow+igvrqfu0...
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\10.0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\ryukreadme.html
C:\documents and settings\user\appdata\locallow\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_netfx20sp2_x86.e_a4c4ba6ff1705b7e5...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\apps\2.0\paxy2tl4.dk6\0l5hj4h1.d17\manifests\google.app_86fd5b6...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\apps\2.0\paxy2tl4.dk6\0l5hj4h1.d17\google.app_86fd5b6b43e66935_...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\53q3wotx\ctum9x1ici2od...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x86_2caea74820267...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x86_289f42c8c0a9d...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_dotnetfx35.exe_4a...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\apphang_{f3364ba0-65b9-1_03f7...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportarchive\noncritical_iexplore.exe_12...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportarchive\appcrash_pafish.exe_afd1595...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\wi...
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\d0ad221...
C:\documents and settings\user\appdata\local\adobe\acrobat\ryukreadme.html
C:\documents and settings\user\appdata\local\ryukreadme.html
C:\documents and settings\user\appdata\ryukreadme.html
C:\documents and settings\user\ryukreadme.html
C:\documents and settings\public\recorded tv\sample media\ryukreadme.html
C:\documents and settings\public\recorded tv\ryukreadme.html
C:\documents and settings\public\libraries\ryukreadme.html
C:\documents and settings\public\downloads\ryukreadme.html
C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
C:\documents and settings\public\ryukreadme.html
C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tm.blf
C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
C:\documents and settings\default\ntuser.dat.log
C:\documents and settings\default\ntuser.dat
C:\documents and settings\default\saved games\ryukreadme.html
C:\documents and settings\default\links\ryukreadme.html
C:\documents and settings\default\favorites\ryukreadme.html
C:\documents and settings\default\downloads\ryukreadme.html
C:\documents and settings\default\documents\my videos\ryukreadme.html
C:\documents and settings\default\documents\my pictures\ryukreadme.html
C:\documents and settings\default\documents\my music\ryukreadme.html
C:\documents and settings\default\documents\ryukreadme.html
C:\documents and settings\default\desktop\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\templates\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me...
C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\cache\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\in...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\fe...
C:\documents and settings\user\appdata\local\application data\application data\adobe\acrobat\10.0\usercache.bin
C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\adobecmapfnt11.lst
C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\shareddataevents
C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\adobesysfnt11.lst
C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\usercache.bin
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ...
C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\shareddataevents
C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv
C:\documents and settings\public\libraries\recordedtv.library-ms
C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\cache\acrofnt10.lst
C:\documents and settings\user\appdata\local\adobe\color\profiles\wscrgb.icc
C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\cache\acrofnt11.lst
C:\documents and settings\user\appdata\local\adobe\color\acecache11.lst
C:\documents and settings\user\appdata\local\adobe\color\profiles\wsrgb.icc
C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\adobesysfnt10.lst
C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\adobecmapfnt10.lst
C:\documents and settings\user\appdata\local\adobe\color\profiles\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\color\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\cache\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\ryukreadme.html
C:\documents and settings\default user\ntuser.dat.log1
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\acrord3...
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab

Moves the following files

from %ALLUSERSPROFILE%\adobe\acrobat\11.0\replicate\security\directories.acrodata to %ALLUSERSPROFILE%\adobe\acrobat\11.0\replicate\security\directories.acrodata.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\696f3de637e6de85b458996d49d759ad to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\696f3de637e6de85b458996d49d759ad.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b8944ba8ad0efdf0e01a43ef62becd0_24e0d7000cefaf417bb7236f66f3cc23 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b8944ba8ad0efdf0e01a43ef62becd0_24e0d7000cefaf417bb7236f66f3cc23.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\94308059b57b3142e455b38a6eb92015 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\94308059b57b3142e455b38a6eb92015.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\update\ver.txt to C:\documents and settings\user\appdata\roaming\icq-profile\update\ver.txt.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\3130b1871a126520a8c47861efe3ed4d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\3130b1871a126520a8c47861efe3ed4d.ryk
from C:\documents and settings\user\appdata\locallow\sun\java\jre1.7.0_11\jre1.7.0_11.msi to C:\documents and settings\user\appdata\locallow\sun\java\jre1.7.0_11\jre1.7.0_11.msi.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_uz.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_uz.csv.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_tr.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_tr.csv.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ru.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ru.csv.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_kz.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_kz.csv.ryk
from C:\documents and settings\user\appdata\roaming\.purple\prefs.xml to C:\documents and settings\user\appdata\roaming\.purple\prefs.xml.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\696f3de637e6de85b458996d49d759ad to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\696f3de637e6de85b458996d49d759ad.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\base\mra.dbs to C:\documents and settings\user\appdata\roaming\icq-profile\base\mra.dbs.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\segoesc.ttf to C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\segoesc.ttf.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\bing.ico to C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\bing.ico.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.aff to C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.aff.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\dll\altergeo.msi to C:\documents and settings\user\appdata\roaming\icqm\icq\dll\altergeo.msi.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl to C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\addressbook.acrodata to C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\addressbook.acrodata.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl to C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\addressbook.acrodata to C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\addressbook.acrodata.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\23b523c9e7746f715d33c6527c18eb9d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\23b523c9e7746f715d33c6527c18eb9d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1daf2884ec4dfa96ba4a58d4dbc9c406 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1daf2884ec4dfa96ba4a58d4dbc9c406.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1daf2884ec4dfa96ba4a58d4dbc9c406 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1daf2884ec4dfa96ba4a58d4dbc9c406.ryk
from C:\documents and settings\user\appdata\roaming\.purple\status.xml to C:\documents and settings\user\appdata\roaming\.purple\status.xml.ryk
from C:\documents and settings\user\appdata\locallow\sun\java\deployment\deployment.properties to C:\documents and settings\user\appdata\locallow\sun\java\deployment\deployment.properties.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\tmdocs.sav to C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\tmdocs.sav.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\tmgrpprm.sav to C:\documents and settings\user\appdata\roaming\adobe\acrobat\11.0\tmgrpprm.sav.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\base\opt.dbs to C:\documents and settings\user\appdata\roaming\icq-profile\base\opt.dbs.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\installerlang.xml to C:\documents and settings\user\appdata\roaming\icq-profile\installerlang.xml.ryk
from C:\documents and settings\user\appdata\locallow\sun\java\au\au.cab to C:\documents and settings\user\appdata\locallow\sun\java\au\au.cab.ryk
from C:\documents and settings\user\appdata\locallow\sun\java\au\au.msi to C:\documents and settings\user\appdata\locallow\sun\java\au\au.msi.ryk
from C:\documents and settings\user\appdata\locallow\sun\java\jre1.7.0_11\data1.cab to C:\documents and settings\user\appdata\locallow\sun\java\jre1.7.0_11\data1.cab.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl to C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl to C:\documents and settings\user\appdata\roaming\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_en.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_en.csv.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b912b2c6928a18b8cd7d50cf08bea95b_f85b8279fa54a31ceec2563f5a8f73e8 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b912b2c6928a18b8cd7d50cf08bea95b_f85b8279fa54a31ceec2563f5a8f73e8.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b8cc409acdbf2a2fe04c56f2875b1fd6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b8cc409acdbf2a2fe04c56f2875b1fd6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ua.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ua.csv.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b8cc409acdbf2a2fe04c56f2875b1fd6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b8cc409acdbf2a2fe04c56f2875b1fd6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_9ec9a77366fa3db60d703f22e947149f to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_9ec9a77366fa3db60d703f22e947149f.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_52e1450a209543a86ce12abd07318056 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_52e1450a209543a86ce12abd07318056.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_52e1450a209543a86ce12abd07318056 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_52e1450a209543a86ce12abd07318056.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40eb206a466c1f1175ccb23e825b3250 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40eb206a466c1f1175ccb23e825b3250.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3130b1871a126520a8c47861efe3ed4d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3130b1871a126520a8c47861efe3ed4d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\23b523c9e7746f715d33c6527c18eb9d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\23b523c9e7746f715d33c6527c18eb9d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_9ec9a77366fa3db60d703f22e947149f to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_9ec9a77366fa3db60d703f22e947149f.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6.ryk
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211652z-145844 to C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211652z-145844.ryk
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211650z-145784 to C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211650z-145784.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netf... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netf...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\documents\my music\sample music\albumart_{5fa05d35-a682-... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\documents\my music\sample music\albumart_{5fa05d35-a682-...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netframeworksdkv1.1_1... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netframeworksdkv1.1_1...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be0... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be0...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\83aa4cc77f591dfc2374580bbd... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\83aa4cc77f591dfc2374580bbd...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\keys\514ca71677b920c425f6892a3cb118c8_5... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\keys\514ca71677b920c425f6892a3cb118c8_5...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{74d0e5d... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{74d0e5d...
from C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms to C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{6c95b50... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{6c95b50...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeaddition... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeaddition...
from C:\documents and settings\default\ntuser.dat to C:\documents and settings\default\ntuser.dat.ryk
from C:\documents and settings\default\ntuser.dat.log to C:\documents and settings\default\ntuser.dat.log.ryk
from C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms to C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms.ryk
from C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tm.blf to C:\documents and settings\default\ntuser.dat{6cced2f1-6e01-11de-8bed-001e0bcd1824}.tm.blf.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition updates\{ccca0d05-... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition updates\{ccca0d05-...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db3765821... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db3765821...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a0... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a0...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{2af972c... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{2af972c...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\c... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\c...
from %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ab0000000001}\data1.cab to %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ab0000000001}\data1.cab.ryk
from %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\arm.msi to %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\arm.msi.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\appli... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\appli...
from %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrsecupd10111.msp to %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrsecupd10111.msp.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\micro... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\micro...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\docum... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\docum...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{615bc16... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{615bc16...
from C:\documents and settings\default user\ntuser.dat.log1 to C:\documents and settings\default user\ntuser.dat.log1.ryk
from %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ab0000000001}\acroread.msi to %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ab0000000001}\acroread.msi.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures\... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures\...
from %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrupd10116.msp to %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrupd10116.msp.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\officesoftwa... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\officesoftwa...
from %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrupd10110.msp to %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdrupd10110.msp.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defe... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defe...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{01db25f... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{01db25f...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music\sam... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music\sam...
from %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdr1010_en_us.msi to %ALLUSERSPROFILE%\adobe\arm\reader_10.0.0\adberdr1010_en_us.msi.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f0080ca... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f0080ca...
from C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\adobecmapfnt10.lst to C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\adobecmapfnt10.lst.ryk
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\sync p... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\sync p...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\r... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\r...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\microsoft .net framework... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\microsoft .net framework...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\53q3w... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\53q3w...
from volume{85074cd1-c6f4-11e6-abb6-080027131f42}\system volume information\tracking.log.tmp to volume{85074cd1-c6f4-11e6-abb6-080027131f42}\system volume information\tracking.log
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feeds for uni... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feeds for uni...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_ndp4... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_ndp4...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\thunderbird\... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\thunderbird\...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\4qwyj... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\4qwyj...
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\10.0\readermessages to C:\documents and settings\user\appdata\locallow\adobe\acrobat\10.0\readermessages.ryk
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\readermessages to C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\readermessages.ryk
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211652z-145865 to C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211652z-145865.ryk
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211650z-145807 to C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211650z-145807.ryk
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211649z-145757 to C:\documents and settings\user\appdata\locallow\adobe\acrobat\11.0\assets\assets-160310211649z-145757.ryk
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\yuk3f... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\yuk3f...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\recovery\last acti... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\recovery\last acti...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\apps\2.0\paxy2tl4.dk6\0l5hj4h1.d17\manifests\google.app_86fd5b6... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\apps\2.0\paxy2tl4.dk6\0l5hj4h1.d17\manifests\google.app_86fd5b6...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_vcre... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_vcre...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\of... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\of...
from C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\adobesysfnt10.lst to C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\adobesysfnt10.lst.ryk
from C:\documents and settings\user\appdata\local\adobe\color\acecache11.lst to C:\documents and settings\user\appdata\local\adobe\color\acecache11.lst.ryk
from C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\cache\acrofnt11.lst to C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\cache\acrofnt11.lst.ryk
from C:\documents and settings\user\appdata\local\adobe\color\profiles\wscrgb.icc to C:\documents and settings\user\appdata\local\adobe\color\profiles\wscrgb.icc.ryk
from C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\cache\acrofnt10.lst to C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\cache\acrofnt10.lst.ryk
from C:\documents and settings\public\libraries\recordedtv.library-ms to C:\documents and settings\public\libraries\recordedtv.library-ms.ryk
from C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\shareddataevents to C:\documents and settings\user\appdata\local\adobe\acrobat\10.0\shareddataevents.ryk
from C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv to C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.ryk
from C:\documents and settings\user\appdata\local\adobe\color\profiles\wsrgb.icc to C:\documents and settings\user\appdata\local\adobe\color\profiles\wsrgb.icc.ryk
from C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\usercache.bin to C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\usercache.bin.ryk
from C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\shareddataevents to C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\shareddataevents.ryk
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ...
from C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\adobecmapfnt11.lst to C:\documents and settings\user\appdata\local\application data\adobe\acrobat\11.0\adobecmapfnt11.lst.ryk
from C:\documents and settings\user\appdata\local\application data\application data\adobe\acrobat\10.0\usercache.bin to C:\documents and settings\user\appdata\local\application data\application data\adobe\acrobat\10.0\usercache.bin.ryk
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\in... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\in...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\acrord3... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\acrord3...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me...
from C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\adobesysfnt11.lst to C:\documents and settings\user\appdata\local\adobe\acrobat\11.0\adobesysfnt11.lst.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b8944ba8ad0efdf0e01a43ef62becd0_24e0d7000cefaf417bb7236f66f3cc23 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b8944ba8ad0efdf0e01a43ef62becd0_24e0d7000cefaf417bb7236f66f3cc23.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9.ryk

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\net.exe' stop "audioendpointbuilder" /y' (with hidden window)
'<SYSTEM32>\net.exe' stop "samss" /y' (with hidden window)

Executes the following

'<SYSTEM32>\net1.exe' stop "audioendpointbuilder" /y
'<SYSTEM32>\net1.exe' stop "samss" /y

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial