Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %ALLUSERSPROFILE%\start menu\programs\startup\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\startup\4qcnd61y88-how-to-decrypt.txt
Creates the following files on removable media
- <Drive name for removable media>:\4qcnd61y88-how-to-decrypt.txt
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\sdszfo.docx
Modifies file system
Creates the following files
- C:\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\cs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\da\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\de\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\el\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\en\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\ru\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\es\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\fil\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\fr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\he\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\hi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\hr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\hu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\ar\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\fi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\bg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_tw\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_cn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\nb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\nl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\pl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_pt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\id\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\ro\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\ko\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\sk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\sr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\sv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\th\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\tr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\uk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\lt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\vi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\sl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\lv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\it\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\lv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\bg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\cs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\da\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\de\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\el\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_cn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\en\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\fi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\fil\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\fr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\hi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\hr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\hu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\ar\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_tw\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\vi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\tr\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\nl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\no\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\pl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_pt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\ja\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\lt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\ko\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\ro\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\sr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\sv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\th\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\tr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\uk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\ru\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\sk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\sl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\ja\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\it\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\id\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ml\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mo\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mr\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ms\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mt\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\my\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ro\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\nb\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\nl\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\nn\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\oc\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\pl\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\pt\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\lt\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ku\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mk\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ko\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\kn\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fr\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\gl\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\gu\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\he\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\hi\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\hr\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\pt_br\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\hu\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ne\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\is\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ja\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\jv\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ka\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\kab\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\kk\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\id\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fy\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\it\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\lv\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ru\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\da\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\de\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\el\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\en\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\en_gb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\bg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\shn\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\cs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\es\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\fil\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\fr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\hi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\hr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\hu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\es_419\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\et\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\fi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\es\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\id\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sl\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sq\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sr\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sv\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ta\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\te\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\th\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ug\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\uk\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ur\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\uz\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\vi\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\wae\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sk\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\tw\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\no\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\browser-region\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\ko\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\th\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\tr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\branding\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\lt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\browser-region\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\openpgp\sap\pkt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\openpgp\sap\util\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\wubi\backends\common\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\wubi\backends\win32\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\wubi\frontends\win32\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ar\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\sl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\openpgp\sap\msg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\sv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\sr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\sk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\ru\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\hr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\hu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\id\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\it\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\ja\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\bg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\ko\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\fr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\lv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\nl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\no\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\pl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_pt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\he\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\ro\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\ms\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\hi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\el\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_pt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ro\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ru\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\nl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\tr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\uk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\vi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_cn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_tw\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\branding\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\no\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\it\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\en\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\es\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fil\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\cs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\de\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\da\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\he\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\id\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\it\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ja\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ko\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\fil\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\fi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\eu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\cs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\da\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\de\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\el\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\en\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\he\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_gb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\es\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\es_419\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\et\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\fi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\fil\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\__macosx\_locales\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_tw\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\bg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_cn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\vi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\lt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\nl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\no\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\pl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_pt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\fr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\ro\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_us\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\se\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\sl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\sr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\th\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\tr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\uk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\ru\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\lv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\sk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\ar\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\hi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\uk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_cn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_tw\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\ar\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\bg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\tr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\hr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\vi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\cs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_gb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_us\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\es\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\es_419\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\et\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\da\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\de\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\el\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fi\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\ja\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\sr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\id\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\it\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\ja\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\ko\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\lt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\lv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\sv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\th\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\nl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_pt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\ro\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\ru\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\sk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\sl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\hu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\pl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\th\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fa\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\el\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\hsperfdata_user\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\lilo.1120\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\microsoft .net framework 4 setup_4.0.30319\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\opera installer\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\start menu\programs\accessories\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\outlook logging\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\adobe_admlogs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\history\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\cookies\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\2.9.0.1467 (partner)\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\mirc\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\qip 2012\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\steam\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\winrar\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\history\history.ie5\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\google chrome\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\start menu\programs\startup\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\history\history.ie5\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\local settings\history\history.ie5\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\favorites\links\почта.url
- %ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\favorites\links\яндекс.url
- C:\documents and settings\localservice\local settings\history\history.ie5\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\microsoft office\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\<INETFILES>\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\z9pmdpek\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\2.9.0.1467 (partner)\chrome\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\history\history.ie5\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\bin\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\data\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\start menu\programs\accessories\entertainment\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\start menu\programs\accessories\accessibility\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\h8mbgrq8\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my videos\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\accessories\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\administrative tools\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\icq\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\telegram desktop\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\winrar\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\accessories\system tools\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ee7gwdg8\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\etuaii8e\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\accessories\communications\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\games\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\administrative tools\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\accessories\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\printhood\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\recent\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\sendto\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\start menu\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\templates\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\cookies\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\my documents\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\.oracle_jre_usage\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\cookies\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\desktop\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\favorites\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\favorites\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\nethood\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\desktop\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\cookies\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\4qcnd61y88-how-to-decrypt.txt
- %ProgramFiles%\4qcnd61y88-how-to-decrypt.txt
- C:\recycler\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\local settings\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\cookies\4qcnd61y88-how-to-decrypt.txt
- C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\drm\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\favorites\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\templates\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\4qcnd61y88-how-to-decrypt.txt
- <Current directory>\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\desktop\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\my documents\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\nethood\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\favorites\links\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\local settings\<INETFILES>\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\my documents\downloads\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\my documents\my music\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\my documents\my pictures\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\printhood\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\local settings\history\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\userdata\ubghkdcj\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my music\my playlists\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my music\sample music\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my music\sample playlists\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my pictures\sample pictures\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\userdata\09upir0l\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\userdata\e3unqlkn\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\userdata\inafedwn\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\local settings\history\history.ie5\mshist012017042620170427\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\winboot\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\<INETFILES>\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\sendto\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\templates\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\userdata\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\voip\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my music\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\history\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\networkservice\local settings\temp\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\documents\my pictures\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\history\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\temp\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\local settings\<INETFILES>\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\default user\start menu\programs\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\history\4qcnd61y88-how-to-decrypt.txt
- C:\documents and settings\localservice\local settings\temp\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\recent\4qcnd61y88-how-to-decrypt.txt
- %ALLUSERSPROFILE%\start menu\programs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\et\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\vi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\wae\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\zh_cn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\zh_hk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\zh_tw\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\_locales\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\__macosx\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\_locales\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_24406\crx_install\__macosx\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\_locales\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\_locales\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\uk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\_locales\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\uz\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ur\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ug\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\tw\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\pl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\pt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\pt_br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ro\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ru\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\shn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\nl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ta\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\te\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\th\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\nn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\tr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\sq\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\oc\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\<INETFILES>\content.ie5\4xoboj8j\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ca\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\crh\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\cs\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\csb\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\cy\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\da\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\bg\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\de\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en_au\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en_ca\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en_gb\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\eo\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\es\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\br\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\bs\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\bo\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ast\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2064_18724\crx_install\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\data\custom-installation\hooks\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\data\custom-installation\packages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\crypto\cipher\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\crypto\hash\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\crypto\publickey\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\<INETFILES>\content.ie5\chyzclen\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\<INETFILES>\content.ie5\ibwpozo7\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\<INETFILES>\content.ie5\g1qjk5mv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\crypto\util\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\xml\parsers\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\xml\sax\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\af\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ar\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\as\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\openpgp\sap\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\wubi\backends\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\wubi\frontends\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ne\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\nb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\my\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\af\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ar\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\as\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ast\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\bg\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\bo\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\de\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\br\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\crh\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\cs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\csb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\cy\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\winui\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\urlgrabber\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\xml\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\sets\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\openpgp\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_28580\crx_install\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\<INETFILES>\content.ie5\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\accessories\accessibility\4qcnd61y88-how-to-decrypt.txt
- %HOMEPATH%\start menu\programs\accessories\entertainment\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\da\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\2.9.0.1467 (partner)\chrome\en-gb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\bs\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\data\custom-installation\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\bittorrent\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\crypto\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\ctypes\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\encodings\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\logging\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\bin\formats\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_9112\crx_install\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\data\images\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\lib\wubi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\el\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ja\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ka\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\kab\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\kk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\kn\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ko\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\it\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\jv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ku\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ml\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mo\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\ms\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\lt\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\lv\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\mk\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\eu\lc_messages\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\scoped_dir_2812_13253\crx_install\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\hu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en_ca\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en_gb\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\eo\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\es\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\et\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\eu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\id\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\is\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fa\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fy\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\gl\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\gu\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\he\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\hi\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\hr\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\en_au\4qcnd61y88-how-to-decrypt.txt
- %TEMP%\pyl1.tmp\translations\fr\4qcnd61y88-how-to-decrypt.txt
- D:\4qcnd61y88-how-to-decrypt.txt
Moves the following files
- from %HOMEPATH%\favorites\links\почта.url to %HOMEPATH%\favorites\links\почта.url.4qcnd61y88
- from %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log.4qcnd61y88
- from %TEMP%\jusched.log to %TEMP%\jusched.log.4qcnd61y88
- from %TEMP%\jaureg.log to %TEMP%\jaureg.log.4qcnd61y88
- from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.4qcnd61y88
- from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.4qcnd61y88
- from %TEMP%\java_install_reg.log to %TEMP%\java_install_reg.log.4qcnd61y88
- from %TEMP%\dd_dotnetfx20error.txt to %TEMP%\dd_dotnetfx20error.txt.4qcnd61y88
- from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.4qcnd61y88
- from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\dd_net_framework30_setup7762.txt.4qcnd61y88
- from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\dd_net_framework35_msi77c4.txt.4qcnd61y88
- from %TEMP%\setupexe(201511201342324e4).log to %TEMP%\setupexe(201511201342324e4).log.4qcnd61y88
- from %TEMP%\setupexe(20151215230521214).log to %TEMP%\setupexe(20151215230521214).log.4qcnd61y88
- from %TEMP%\dd_net_framework20_setup74f9.txt to %TEMP%\dd_net_framework20_setup74f9.txt.4qcnd61y88
- from %TEMP%\setupexe(2015121523093290).log to %TEMP%\setupexe(2015121523093290).log.4qcnd61y88
- from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd_wcf_retca4a2a.txt.4qcnd61y88
- from %TEMP%\dd_xps.txt to %TEMP%\dd_xps.txt.4qcnd61y88
- from %TEMP%\dd_vcredist_x86_20151215221751.log to %TEMP%\dd_vcredist_x86_20151215221751.log.4qcnd61y88
- from %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log.4qcnd61y88
- from %TEMP%\dd_dotnetfx35install.txt to %TEMP%\dd_dotnetfx35install.txt.4qcnd61y88
- from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.4qcnd61y88
- from %TEMP%\adobearm.log to %TEMP%\adobearm.log.4qcnd61y88
- from %TEMP%\aucheck_parser.txt to %TEMP%\aucheck_parser.txt.4qcnd61y88
- from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.4qcnd61y88
- from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.4qcnd61y88
- from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.4qcnd61y88
- from %TEMP%\uxeventlog.txt to %TEMP%\uxeventlog.txt.4qcnd61y88
- from %TEMP%\java_install.log to %TEMP%\java_install.log.4qcnd61y88
- from %TEMP%\dd_clwireg.txt to %TEMP%\dd_clwireg.txt.4qcnd61y88
- from %TEMP%\dd_dotnetfx35error.txt to %TEMP%\dd_dotnetfx35error.txt.4qcnd61y88
- from %TEMP%\dd_dotnetfx20install.txt to %TEMP%\dd_dotnetfx20install.txt.4qcnd61y88
- from %TEMP%\dd_depcheck_netfx_exp_35.txt to %TEMP%\dd_depcheck_netfx_exp_35.txt.4qcnd61y88
- from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.4qcnd61y88
- from %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt to %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.4qcnd61y88
- from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.4qcnd61y88
- from %HOMEPATH%\favorites\links\яндекс.url to %HOMEPATH%\favorites\links\яндекс.url.4qcnd61y88
- from %TEMP%\dd_depcheck_netfx20_exp_35.txt to %TEMP%\dd_depcheck_netfx20_exp_35.txt.4qcnd61y88
- from %TEMP%\wubi-14.04-rev286.log to %TEMP%\wubi-14.04-rev286.log.4qcnd61y88
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
