Trojan.Encoder.29795

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop "audioendpointbuilder" /y
'%WINDIR%\syswow64\net.exe' stop "samss" /y

Modifies file system

Creates the following files

<Current directory>\dmlacte.exe
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\33\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\28\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\29\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\3\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\30\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\31\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\32\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\34\ryukreadme.html
C:\documents and settings\user\appdata\locallow\oracle\java\au\au.msi
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\35\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\36\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\37\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\38\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\39\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\4\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\27\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\26\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\16\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\17\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\18\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\40\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\13\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\19\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\21\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\23\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\24\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\25\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\2\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\20\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\41\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\22\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\42\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\60\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\45\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\62\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\63\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\7\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\8\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\6\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\59\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\61\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\9\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\tmp\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\tmp\si\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\jre1.8.0_45_x64\ryukreadme.html
C:\documents and settings\user\appdata\roaming\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\host\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\muffin\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\security\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\15\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\12\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\43\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\46\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\47\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\48\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\49\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\58\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\44\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\57\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\5\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\53\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\54\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\55\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\56\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\50\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\51\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\52\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\14\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\11\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\10\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_f143ed572a5ae1ea3e4803b606227802
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\82414f9d7ab8999991ffeb2bc378a4eb_38d56666351d269f7164e27288ce56de
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\26ad01f9c002fad37427e734302383d8_e1df8f31180beed965ca2cd894b8b7b4
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_eec030e6942974d9d4164d25cccfbc48
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\9a19adad9d098e039450abbedd5616eb_e53dc76f1da8e9b42c3c2676d4662fc7
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_1e5d470765e0be1964814b1f5a3581dc
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8ea86c033c277996c7ee317e0f0e3b25_a2199d1d7052b20e3ec3f27b5eefdb7c
C:\documents and settings\user\appdata\roaming\adobe\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\9a19adad9d098e039450abbedd5616eb_6cfcd4fbf61133487624b372eb19b24f
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\af48eb7f5955ea9f651376f7f40da1ad_4ad96472af2e72cc9c741bd59f4aa39b
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_b4ddaf0ed6439057fc208eaaaff3f39b
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\40e450f7ce13419a2ccc2a5445035a0a_f663f250e172d75637ee387588ab955d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\3130b1871a126520a8c47861efe3ed4d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\fe0da2326a35120037f66779d450c7d6_78fb178a52778bdedc9c9955dd948b91
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_28e28b4290972ff3ae54759753fb4e28
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7d266d9e1e69fa1eefb9699b009b34c8_ffe23a7c282c1690704b5aea6161d1b8
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\5b565e5a03c1711296156e2e5be2718c_00cf1898382336fe22c0340da9aa6678
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\4c8f841fb02dec8c10108028db86a08d_f7f52d12b44c3bd66604e564ec47d429
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\2b47c79e2e98ad8397aafbb0ffd6f673_affb20fff237be0d2ed9b6a73bceda60
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\23b523c9e7746f715d33c6527c18eb9d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_363d5fe3bcc68cdce1f919415e437676
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1daf2884ec4dfa96ba4a58d4dbc9c406
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b8cc409acdbf2a2fe04c56f2875b1fd6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf
C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\ryukreadme.html
C:\documents and settings\user\appdata\locallow\oracle\ryukreadme.html
C:\documents and settings\user\appdata\locallow\oracle\java\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b4378bd2e36b69deced3e341bd654801_5aa28880debaed521f3e1764e7ad61bc
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\0\ryukreadme.html
C:\documents and settings\user\appdata\locallow\oracle\java\au\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\cache\6.0\1\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b912b2c6928a18b8cd7d50cf08bea95b_a0a4e63d002fe2d2feb4730a59beaf43
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\fe0da2326a35120037f66779d450c7d6_78fb178a52778bdedc9c9955dd948b91
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\dce3bdbf5bdd86e2ab5b471cb90709b4_5635495f4719560e108f322cbeb794a5
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\dce3bdbf5bdd86e2ab5b471cb90709b4_b2a071bed1997907e6bd9195b7aba315
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_155e354725a8a9b8c1800778d5d8440a
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\fb788e090bc1f3aa2fbc9e8fb2859601
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9
C:\documents and settings\user\appdata\locallow\sun\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\fb788e090bc1f3aa2fbc9e8fb2859601
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6
C:\documents and settings\user\appdata\roaming\adobe\acrobat\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\jscache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\loading\loading.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\loading\loading.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\loading\loading.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\loading\loading.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\error\error_general.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-offline.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\jabber\warning.png
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\jabber\facebook.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\error\exclamation.jpg
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\jabber\facebook.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\jabber\gtalk.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\jabber\jabber.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\error\exclamation.jpg
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\error\error_general.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\jabber\warning.png
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\jabber\jabber.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\jabber\facebook.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\phone.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\icq_offline.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\error\exclamation.jpg
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-offline-inv.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\jabber\warning.png
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\agent_online_inv.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\jabber\gtalk.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\error\error_general.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\jabber\warning.png
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\jabber\vkontakte.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\jabber\facebook.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\jabber\vkontakte.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\error\error_news.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\jabber\gtalk.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-decline.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\jabber\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\jabber\gtalk.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\loading\progress_agent.gif
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\loading\progress_agent.gif
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\jabber\jabber.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\jabber\facebook.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\jabber\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\jabber\vkontakte.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\jabber\vkontakte.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\error\error_update.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\icq_online.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\loading\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\pt\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-decline-mouse.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-busy.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\phone_inv.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\error\error_general.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\error\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\icq_offline_inv.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\error\error_update.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\error\error_news.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\error\error_general.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\kz\error\error_news.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\error\exclamation.jpg
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\error\error_update.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\jabber\jabber.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\error\exclamation.jpg
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\error\error_update.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\jabber\vkontakte.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\loading\progress_agent.gif
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\error\error_news.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\jabber\warning.png
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\error\error_update.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\error\error_news.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\loading\progress_agent.gif
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\loading\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\error\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\...
C:\documents and settings\user\appdata\roaming\icqm\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\logtransport2\logtransport2.cfg
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl
C:\documents and settings\user\appdata\roaming\icq-profile\update\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\base\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata
C:\documents and settings\user\appdata\roaming\icq-profile\base\opt.dbs
C:\documents and settings\user\appdata\roaming\icq-profile\base\mra.dbs
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\tmgrpprm.sav
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\preferences\defaultheuristics.dat
C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.aff
C:\documents and settings\user\appdata\roaming\icq-profile\installerlang.xml
C:\documents and settings\user\appdata\roaming\icq-profile\update\splash_banner\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\tmdocs.sav
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\preferences\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\flash player\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\forms\ryukreadme.html
C:\documents and settings\user\appdata\roaming\ghisler\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\flash player\assetcache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\headlights\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\linguistics\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\logtransport2\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\logtransport2\logs\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\flash player\assetcache\reehzff2\ryukreadme.html
C:\documents and settings\user\appdata\locallow\sun\java\deployment\deployment.properties
C:\documents and settings\user\appdata\roaming\adobe\flash player\nativecache\ryukreadme.html
C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\collab\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.dict
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_uz.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\error\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\agent_offline.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\jabber\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\error\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-online-inv.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\loading\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\cz\loading\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\jabber\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\loading\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\agent_online.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\error\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\agent_offline_inv.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\jabber\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\database\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\dll\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.hash
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ua.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_tr.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-online.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\html\bg\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ru.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_en.csv
C:\documents and settings\user\appdata\roaming\icqm\icq\dll\altergeo.msi
C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\segoesc.ttf
C:\documents and settings\user\appdata\roaming\icqm\icq\html\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\ryukreadme.html
C:\documents and settings\user\appdata\roaming\icq-profile\update\ver.txt
C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_kz.csv
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\223de96ee265046957a660ed7c9dd9e7_eff9b9ba98deaa773f261fa85a0b1771
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\af48eb7f5955ea9f651376f7f40da1ad_4ad96472af2e72cc9c741bd59f4aa39b
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b4378bd2e36b69deced3e341bd654801_5aa28880debaed521f3e1764e7ad61bc
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14....
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14....
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c41...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a71...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14....
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c53232...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeaddition...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeaddition...
C:\documents and settings\default\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14....
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-...
C:\documents and settings\default\appdata\roaming\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db3765821...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-177...
C:\documents and settings\default\appdata\local\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\windows\projects\syst...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\mi...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_3...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be0...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netframeworksdkv1.1_1...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\p...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a0...
C:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\applicati...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition updates\{d2b0b133-...
C:\documents and settings\user\appdata\local\adobe\ryukreadme.html
C:\documents and settings\default\appdata\roaming\media center programs\ryukreadme.html
C:\documents and settings\default\documents\my pictures\ryukreadme.html
C:\documents and settings\default\documents\my videos\ryukreadme.html
C:\documents and settings\default\downloads\ryukreadme.html
C:\documents and settings\default\favorites\ryukreadme.html
C:\documents and settings\default\links\ryukreadme.html
C:\documents and settings\default\documents\ryukreadme.html
C:\documents and settings\default\saved games\ryukreadme.html
C:\documents and settings\default\desktop\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\ryukreadme.html
C:\documents and settings\public\recorded tv\ryukreadme.html
C:\documents and settings\public\recorded tv\sample media\ryukreadme.html
C:\documents and settings\user\ryukreadme.html
C:\documents and settings\user\appdata\ryukreadme.html
C:\documents and settings\public\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-...
C:\documents and settings\public\downloads\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\documents\my music\sample music\albumart_{5fa05d35-a682-...
C:\documents and settings\default\appdata\roaming\microsoft\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\cookies\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\network shortcuts\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\templates\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\printer shortcuts\ryukreadme.html
C:\documents and settings\default\documents\my music\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\ryukreadme.html
C:\documents and settings\default\appdata\roaming\microsoft\windows\recent\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{a2563e55-3bec-3828-8d67-...
C:\documents and settings\default\appdata\roaming\microsoft\windows\sendto\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netf...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{0d3e9e15-de7a-300b-96f1-...
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\adobe\arm\reader_15.00...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\docum...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\micro...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\appli...
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
C:\documents and settings\user\appdata\local\ryukreadme.html
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\oracl...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\netframework...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music\sam...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures\...
%ALLUSERSPROFILE%\adobe\arm\s\armmanifest.msi
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\c...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\event viewer...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\officesoftwa...
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\ryukreadme.html
%PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%ALLUSERSPROFILE%\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\s\10428\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\s\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\ryukreadme.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\ryukreadme.html
%ALLUSERSPROFILE%\adobe\ryukreadme.html
%ALLUSERSPROFILE%\adobe\setup\ryukreadme.html
C:\ryukreadme.html
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\ryukreadme.html
D:\$recycle.bin\ryukreadme.html
D:\ryukreadme.html
%TEMP%\ryukreadme.html
C:\documents and settings\ryukreadme.html
C:\documents and settings\public\libraries\ryukreadme.html
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\user account...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\powe...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f65db02...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\ac...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\ad...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\k-...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{dde2682...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{ce085a7...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f0080ca...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\mi...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{e35be42d-f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\client\1.0\en-us\h...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\wind...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\package cache\42d5bec7ddfbd49e76467529c...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\device\{113527a4...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\device\{8702d817...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stage\task\{07deb856-f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{e46eca4...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\...
%ALLUSERSPROFILE%\application data\adobe\arm\reader_15.007.20033\readerdcmanifest.msi
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defe...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows nt\m...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\42d5bec7...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{01db25f...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{b55f720...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\devi...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{a219961...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{0f12c81...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{51adbf1...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{615bc16...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{6c95b50...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{74d0e5d...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{2af972c...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{33d1fd9...
%ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{35459b2...
C:\documents and settings\default\appdata\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrobat\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\223de96ee265046957a660ed7c9dd9e7_eff9b9ba98deaa773f261fa85a0b1771
C:\documents and settings\user\appdata\locallow\adobe\acrobat\dc\readermessages
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\94308059b57b3142e455b38a6eb92015
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\12b9db160ad5c40a43865b2b20626f11_562b4db7e667dcc825a4240df458a240
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\12b9db160ad5c40a43865b2b20626f11_562b4db7e667dcc825a4240df458a240
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1daf2884ec4dfa96ba4a58d4dbc9c406
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\2b47c79e2e98ad8397aafbb0ffd6f673_affb20fff237be0d2ed9b6a73bceda60
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3130b1871a126520a8c47861efe3ed4d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_f663f250e172d75637ee387588ab955d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\696f3de637e6de85b458996d49d759ad
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\23b523c9e7746f715d33c6527c18eb9d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\26ad01f9c002fad37427e734302383d8_e1df8f31180beed965ca2cd894b8b7b4
C:\documents and settings\default\ntuser.dat
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\4c8f841fb02dec8c10108028db86a08d_f7f52d12b44c3bd66604e564ec47d429
C:\documents and settings\user\appdata\locallow\adobe\acrobat\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\dc\search\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\dc\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\all\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\en_gb\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\en_us\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\nl_nl\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\de_ch\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\de_de\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\linguistics\userdictionaries\adobe custom dictionary\en_ca\ryukreadme.html
C:\documents and settings\user\appdata\locallow\adobe\acrobat\dc\assets\ryukreadme.html
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\5b565e5a03c1711296156e2e5be2718c_00cf1898382336fe22c0340da9aa6678
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7d266d9e1e69fa1eefb9699b009b34c8_ffe23a7c282c1690704b5aea6161d1b8
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_28e28b4290972ff3ae54759753fb4e28
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\dce3bdbf5bdd86e2ab5b471cb90709b4_5635495f4719560e108f322cbeb794a5
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b912b2c6928a18b8cd7d50cf08bea95b_a0a4e63d002fe2d2feb4730a59beaf43
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b8cc409acdbf2a2fe04c56f2875b1fd6
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_363d5fe3bcc68cdce1f919415e437676
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_155e354725a8a9b8c1800778d5d8440a
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\dce3bdbf5bdd86e2ab5b471cb90709b4_b2a071bed1997907e6bd9195b7aba315
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\696f3de637e6de85b458996d49d759ad
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\9a19adad9d098e039450abbedd5616eb_e53dc76f1da8e9b42c3c2676d4662fc7
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\9a19adad9d098e039450abbedd5616eb_6cfcd4fbf61133487624b372eb19b24f
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_b4ddaf0ed6439057fc208eaaaff3f39b
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_eec030e6942974d9d4164d25cccfbc48
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\82414f9d7ab8999991ffeb2bc378a4eb_38d56666351d269f7164e27288ce56de
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_f143ed572a5ae1ea3e4803b606227802
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8ea86c033c277996c7ee317e0f0e3b25_a2199d1d7052b20e3ec3f27b5eefdb7c
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_1e5d470765e0be1964814b1f5a3581dc
C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\icq_online_inv.bmp
C:\documents and settings\user\appdata\roaming\icqm\icq\graphics\phone\screen-busy-mouse.bmp
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\re1n75kr\8gc0kolxvga0p8yqaftzeevzch1b52...
C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
C:\documents and settings\user\appdata\local\application data\adobe\color\profiles\wsrgb.icc
C:\documents and settings\user\appdata\local\adobe\color\profiles\wscrgb.icc
C:\documents and settings\user\appdata\local\adobe\acrobat\dc\usercache.bin
C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cache\ryukreadme.html
C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
C:\documents and settings\user\appdata\local\adobe\acrobat\dc\iconcacherdr.dat
C:\documents and settings\user\appdata\local\application data\application data\application data\adobe\acrobat\dc\adobesysfnt15.lst
C:\documents and settings\user\appdata\local\adobe\acrobat\dc\shareddataevents
C:\documents and settings\user\appdata\local\application data\adobe\acrocef\dc\acrobat\cache\index
C:\documents and settings\user\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cache\data_1
C:\documents and settings\user\appdata\local\application data\application data\application data\adobe\acrobat\dc\adobecmapfnt15.lst
C:\documents and settings\user\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cache\data_3
C:\documents and settings\user\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cache\data_2
C:\documents and settings\user\appdata\locallow\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ...
C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cache\data_0
C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cookie\cookies
C:\documents and settings\user\appdata\local\adobe\acrobat\dc\cache\acrofnt15.lst
C:\documents and settings\user\appdata\local\adobe\color\profiles\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\color\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cookie\ryukreadme.html
C:\documents and settings\public\libraries\recordedtv.library-ms
C:\documents and settings\user\appdata\local\application data\application data\adobe\color\acecache11.lst
C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrocef\dc\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrocef\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrobat\dc\toolssearchcacherdr\ryukreadme.html
C:\documents and settings\user\appdata\local\adobe\acrobat\dc\cache\ryukreadme.html
C:\documents and settings\default\ntuser.dat.log
C:\documents and settings\user\appdata\local\adobe\acrobat\dc\ryukreadme.html
C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv
C:\documents and settings\user\appdata\locallow\adobe\ryukreadme.html
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\fe...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\wi...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\re1n7...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\temp\temp1_fp_13.0.0.182_archive.zip\fp_13.0.0...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\recovery\high\acti...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\in...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lp...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\microsoft .net framework...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\dil-contents-...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\caasbycl\satellitelib-...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\vt12abarw5hnohlt-y66pkclfe7azd...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5bke\fdc5uco11re5u283tqazmjrjqbqgkv...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\wxgyhhpdzg-ed4sr0bqelbfmapgw1p...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_4017a4527469f...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5bke\mbox-contents...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_43794547328c2...
C:\documents and settings\default\ntuser.dat.log1
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\acrord3...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\temp1_f...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\of...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\microso...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_vcre...
volume{600ba660-c712-11e6-a54f-080027cffa47}\system volume information\tracking.log.tmp
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\temp1_fp_13.0.0.182_arch...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\microsoft visual c++ 201...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\{5588acfd-643...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feeds for uni...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\art ca...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\sync p...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\r...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_ndp4...
C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\thunderbird\...
C:\documents and settings\user\appdata\roaming\icqm\icq\html\pt\error\ryukreadme.html

Moves the following files

from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\appli... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\appli...
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\5b565e5a03c1711296156e2e5be2718c_00cf1898382336fe22c0340da9aa6678 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\5b565e5a03c1711296156e2e5be2718c_00cf1898382336fe22c0340da9aa6678.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7d266d9e1e69fa1eefb9699b009b34c8_ffe23a7c282c1690704b5aea6161d1b8 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7d266d9e1e69fa1eefb9699b009b34c8_ffe23a7c282c1690704b5aea6161d1b8.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_363d5fe3bcc68cdce1f919415e437676 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_363d5fe3bcc68cdce1f919415e437676.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\fe0da2326a35120037f66779d450c7d6_78fb178a52778bdedc9c9955dd948b91 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\fe0da2326a35120037f66779d450c7d6_78fb178a52778bdedc9c9955dd948b91.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\26ad01f9c002fad37427e734302383d8_e1df8f31180beed965ca2cd894b8b7b4 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\26ad01f9c002fad37427e734302383d8_e1df8f31180beed965ca2cd894b8b7b4.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\3130b1871a126520a8c47861efe3ed4d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\3130b1871a126520a8c47861efe3ed4d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\40e450f7ce13419a2ccc2a5445035a0a_f663f250e172d75637ee387588ab955d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\40e450f7ce13419a2ccc2a5445035a0a_f663f250e172d75637ee387588ab955d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\23b523c9e7746f715d33c6527c18eb9d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\23b523c9e7746f715d33c6527c18eb9d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_28e28b4290972ff3ae54759753fb4e28 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_28e28b4290972ff3ae54759753fb4e28.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_b4ddaf0ed6439057fc208eaaaff3f39b to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_b4ddaf0ed6439057fc208eaaaff3f39b.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_eec030e6942974d9d4164d25cccfbc48 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_eec030e6942974d9d4164d25cccfbc48.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_f143ed572a5ae1ea3e4803b606227802 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_f143ed572a5ae1ea3e4803b606227802.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\82414f9d7ab8999991ffeb2bc378a4eb_38d56666351d269f7164e27288ce56de to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\82414f9d7ab8999991ffeb2bc378a4eb_38d56666351d269f7164e27288ce56de.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\af48eb7f5955ea9f651376f7f40da1ad_4ad96472af2e72cc9c741bd59f4aa39b to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\af48eb7f5955ea9f651376f7f40da1ad_4ad96472af2e72cc9c741bd59f4aa39b.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\4c8f841fb02dec8c10108028db86a08d_f7f52d12b44c3bd66604e564ec47d429 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\4c8f841fb02dec8c10108028db86a08d_f7f52d12b44c3bd66604e564ec47d429.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\2b47c79e2e98ad8397aafbb0ffd6f673_affb20fff237be0d2ed9b6a73bceda60 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\2b47c79e2e98ad8397aafbb0ffd6f673_affb20fff237be0d2ed9b6a73bceda60.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_363d5fe3bcc68cdce1f919415e437676 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_363d5fe3bcc68cdce1f919415e437676.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8ea86c033c277996c7ee317e0f0e3b25_a2199d1d7052b20e3ec3f27b5eefdb7c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8ea86c033c277996c7ee317e0f0e3b25_a2199d1d7052b20e3ec3f27b5eefdb7c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\82414f9d7ab8999991ffeb2bc378a4eb_38d56666351d269f7164e27288ce56de to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\82414f9d7ab8999991ffeb2bc378a4eb_38d56666351d269f7164e27288ce56de.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_6b5c8b321ca02275a82e95fa81d6de62.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\828298824ea5549947c17ddabf6871f5_d1bcee7e304f0d5fb8aa811d9b2d0835.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_1e5d470765e0be1964814b1f5a3581dc to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_1e5d470765e0be1964814b1f5a3581dc.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8ea86c033c277996c7ee317e0f0e3b25_a2199d1d7052b20e3ec3f27b5eefdb7c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8ea86c033c277996c7ee317e0f0e3b25_a2199d1d7052b20e3ec3f27b5eefdb7c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\9a19adad9d098e039450abbedd5616eb_6cfcd4fbf61133487624b372eb19b24f to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\9a19adad9d098e039450abbedd5616eb_6cfcd4fbf61133487624b372eb19b24f.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_1e5d470765e0be1964814b1f5a3581dc to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_1e5d470765e0be1964814b1f5a3581dc.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_eec030e6942974d9d4164d25cccfbc48 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_eec030e6942974d9d4164d25cccfbc48.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\9a19adad9d098e039450abbedd5616eb_e53dc76f1da8e9b42c3c2676d4662fc7 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\9a19adad9d098e039450abbedd5616eb_e53dc76f1da8e9b42c3c2676d4662fc7.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\223de96ee265046957a660ed7c9dd9e7_eff9b9ba98deaa773f261fa85a0b1771 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\223de96ee265046957a660ed7c9dd9e7_eff9b9ba98deaa773f261fa85a0b1771.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1daf2884ec4dfa96ba4a58d4dbc9c406 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1daf2884ec4dfa96ba4a58d4dbc9c406.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b4378bd2e36b69deced3e341bd654801_5aa28880debaed521f3e1764e7ad61bc to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b4378bd2e36b69deced3e341bd654801_5aa28880debaed521f3e1764e7ad61bc.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b8cc409acdbf2a2fe04c56f2875b1fd6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b8cc409acdbf2a2fe04c56f2875b1fd6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b912b2c6928a18b8cd7d50cf08bea95b_a0a4e63d002fe2d2feb4730a59beaf43 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b912b2c6928a18b8cd7d50cf08bea95b_a0a4e63d002fe2d2feb4730a59beaf43.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\dce3bdbf5bdd86e2ab5b471cb90709b4_5635495f4719560e108f322cbeb794a5 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\dce3bdbf5bdd86e2ab5b471cb90709b4_5635495f4719560e108f322cbeb794a5.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\dce3bdbf5bdd86e2ab5b471cb90709b4_b2a071bed1997907e6bd9195b7aba315 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\dce3bdbf5bdd86e2ab5b471cb90709b4_b2a071bed1997907e6bd9195b7aba315.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_155e354725a8a9b8c1800778d5d8440a to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_155e354725a8a9b8c1800778d5d8440a.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3.ryk
from volume{600ba660-c712-11e6-a54f-080027cffa47}\system volume information\tracking.log.tmp to volume{600ba660-c712-11e6-a54f-080027cffa47}\system volume information\tracking.log
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9.ryk
from C:\documents and settings\user\appdata\locallow\sun\java\deployment\deployment.properties to C:\documents and settings\user\appdata\locallow\sun\java\deployment\deployment.properties.ryk
from C:\documents and settings\user\appdata\locallow\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi to C:\documents and settings\user\appdata\locallow\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.ryk
from C:\documents and settings\user\appdata\roaming\adobe\logtransport2\logtransport2.cfg to C:\documents and settings\user\appdata\roaming\adobe\logtransport2\logtransport2.cfg.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl to C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata to C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.aff to C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.aff.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\preferences\defaultheuristics.dat to C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\preferences\defaultheuristics.dat.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\installerlang.xml to C:\documents and settings\user\appdata\roaming\icq-profile\installerlang.xml.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\base\opt.dbs to C:\documents and settings\user\appdata\roaming\icq-profile\base\opt.dbs.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\base\mra.dbs to C:\documents and settings\user\appdata\roaming\icq-profile\base\mra.dbs.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl to C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.ryk
from C:\documents and settings\user\appdata\locallow\oracle\java\au\au.msi to C:\documents and settings\user\appdata\locallow\oracle\java\au\au.msi.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_b4ddaf0ed6439057fc208eaaaff3f39b to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_b4ddaf0ed6439057fc208eaaaff3f39b.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico to C:\documents and settings\user\appdata\locallow\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ua.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ua.csv.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_tr.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_tr.csv.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ru.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_ru.csv.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\tmgrpprm.sav to C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\tmgrpprm.sav.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.hash to C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.hash.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\update\ver.txt to C:\documents and settings\user\appdata\roaming\icq-profile\update\ver.txt.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_kz.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_kz.csv.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_en.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_en.csv.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\dll\altergeo.msi to C:\documents and settings\user\appdata\roaming\icqm\icq\dll\altergeo.msi.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\segoesc.ttf to C:\documents and settings\user\appdata\roaming\icqm\icq\fonts\segoesc.ttf.ryk
from C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.dict to C:\documents and settings\user\appdata\roaming\icq-profile\update\languages.dict.ryk
from C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\tmdocs.sav to C:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\tmdocs.sav.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_f143ed572a5ae1ea3e4803b606227802 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_f143ed572a5ae1ea3e4803b606227802.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\fb788e090bc1f3aa2fbc9e8fb2859601 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\fb788e090bc1f3aa2fbc9e8fb2859601.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_16756cc7371bb76a269719aa1471e96c.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\a053cfb63fc8e6507871752236b5ccd5_ee2f772882d1f0dcc7e8819266c43356.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\acf244f1a10d4dbed0d88eba0c43a9b5_ee1c98f0db5a340329cfbf08da0dfec3.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\af48eb7f5955ea9f651376f7f40da1ad_4ad96472af2e72cc9c741bd59f4aa39b to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\af48eb7f5955ea9f651376f7f40da1ad_4ad96472af2e72cc9c741bd59f4aa39b.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b4378bd2e36b69deced3e341bd654801_5aa28880debaed521f3e1764e7ad61bc to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b4378bd2e36b69deced3e341bd654801_5aa28880debaed521f3e1764e7ad61bc.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b8cc409acdbf2a2fe04c56f2875b1fd6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b8cc409acdbf2a2fe04c56f2875b1fd6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b912b2c6928a18b8cd7d50cf08bea95b_a0a4e63d002fe2d2feb4730a59beaf43 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\b912b2c6928a18b8cd7d50cf08bea95b_a0a4e63d002fe2d2feb4730a59beaf43.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\dce3bdbf5bdd86e2ab5b471cb90709b4_5635495f4719560e108f322cbeb794a5 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\dce3bdbf5bdd86e2ab5b471cb90709b4_5635495f4719560e108f322cbeb794a5.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\dce3bdbf5bdd86e2ab5b471cb90709b4_b2a071bed1997907e6bd9195b7aba315 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\dce3bdbf5bdd86e2ab5b471cb90709b4_b2a071bed1997907e6bd9195b7aba315.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\fe0da2326a35120037f66779d450c7d6_78fb178a52778bdedc9c9955dd948b91 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\fe0da2326a35120037f66779d450c7d6_78fb178a52778bdedc9c9955dd948b91.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\9a19adad9d098e039450abbedd5616eb_6cfcd4fbf61133487624b372eb19b24f to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\9a19adad9d098e039450abbedd5616eb_6cfcd4fbf61133487624b372eb19b24f.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\9a19adad9d098e039450abbedd5616eb_e53dc76f1da8e9b42c3c2676d4662fc7 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\9a19adad9d098e039450abbedd5616eb_e53dc76f1da8e9b42c3c2676d4662fc7.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\fb788e090bc1f3aa2fbc9e8fb2859601 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\fb788e090bc1f3aa2fbc9e8fb2859601.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e887e036775f4159e2816b7b9e527e5f_188ddefe0b86e3f08a8f385c69f753e6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_f6ab1c86fb0c74897ac7f2cb403cfb96.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_155e354725a8a9b8c1800778d5d8440a to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\e4f76c0c82655fd6506668127fa0acd1_155e354725a8a9b8c1800778d5d8440a.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_8b17c4bd8287909c8844443e594d6785.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_467a4875880161cf25efc1554514b77d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_41226e73d19cdccf5b65534f25f83301.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a0... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a0...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_3... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_3...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be0... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be0...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netframeworksdkv1.1_1... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netframeworksdkv1.1_1...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition updates\{d2b0b133-... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition updates\{d2b0b133-...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeaddition... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeaddition...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeaddition... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeaddition...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netf... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\ms.netf...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{33d1fd9... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{33d1fd9...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db3765821... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db3765821...
from C:\documents and settings\default\ntuser.dat to C:\documents and settings\default\ntuser.dat.ryk
from C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cache\data_0 to C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cache\data_0.ryk
from C:\documents and settings\default\ntuser.dat.log to C:\documents and settings\default\ntuser.dat.log.ryk
from C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv to C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.ryk
from C:\documents and settings\user\appdata\local\application data\application data\adobe\color\acecache11.lst to C:\documents and settings\user\appdata\local\application data\application data\adobe\color\acecache11.lst.ryk
from C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms to C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.ryk
from C:\documents and settings\default\ntuser.dat.log1 to C:\documents and settings\default\ntuser.dat.log1.ryk
from C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms to C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.ryk
from C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf to C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.ryk
from C:\documents and settings\user\appdata\local\application data\adobe\color\profiles\wsrgb.icc to C:\documents and settings\user\appdata\local\application data\adobe\color\profiles\wsrgb.icc.ryk
from C:\documents and settings\public\libraries\recordedtv.library-ms to C:\documents and settings\public\libraries\recordedtv.library-ms.ryk
from C:\documents and settings\user\appdata\local\adobe\acrobat\dc\cache\acrofnt15.lst to C:\documents and settings\user\appdata\local\adobe\acrobat\dc\cache\acrofnt15.lst.ryk
from C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cookie\cookies to C:\documents and settings\user\appdata\local\adobe\acrocef\dc\acrobat\cookie\cookies.ryk
from C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\loading\progress_agent.gif to C:\documents and settings\user\appdata\roaming\icqm\icq\html\en\loading\progress_agent.gif.ryk
from C:\documents and settings\user\appdata\local\application data\application data\application data\adobe\acrobat\dc\adobecmapfnt15.lst to C:\documents and settings\user\appdata\local\application data\application data\application data\adobe\acrobat\dc\adobecmapfnt15.lst.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{e46eca4... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{e46eca4...
from %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab to %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.ryk
from %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi to %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\adobe\arm\reader_15.00... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\adobe\arm\reader_15.00...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\micro... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\micro...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\oracl... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\oracl...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures\... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures\...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music\sam... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music\sam...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\c... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\c...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\officesoftwa... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\officesoftwa...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defe... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defe...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{2af972c... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{2af972c...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{74d0e5d... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{74d0e5d...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{01db25f... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{01db25f...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{b55f720... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{b55f720...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{615bc16... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{615bc16...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{a219961... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{a219961...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{dde2682... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{dde2682...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{6c95b50... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{6c95b50...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f65db02... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f65db02...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f0080ca... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f0080ca...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{51adbf1... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{51adbf1...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{0f12c81... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{0f12c81...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{ce085a7... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{ce085a7...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\docum... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\docum...
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{35459b2... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{35459b2...
from C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_uz.csv to C:\documents and settings\user\appdata\roaming\icqm\icq\database\citylist_uz.csv.ryk
from C:\documents and settings\user\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cache\data_3 to C:\documents and settings\user\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cache\data_3.ryk
from C:\documents and settings\user\appdata\local\adobe\acrobat\dc\shareddataevents to C:\documents and settings\user\appdata\local\adobe\acrobat\dc\shareddataevents.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1daf2884ec4dfa96ba4a58d4dbc9c406 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1daf2884ec4dfa96ba4a58d4dbc9c406.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\223de96ee265046957a660ed7c9dd9e7_eff9b9ba98deaa773f261fa85a0b1771 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\223de96ee265046957a660ed7c9dd9e7_eff9b9ba98deaa773f261fa85a0b1771.ryk
from C:\documents and settings\user\appdata\locallow\adobe\acrobat\dc\readermessages to C:\documents and settings\user\appdata\locallow\adobe\acrobat\dc\readermessages.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\23b523c9e7746f715d33c6527c18eb9d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\23b523c9e7746f715d33c6527c18eb9d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\26ad01f9c002fad37427e734302383d8_e1df8f31180beed965ca2cd894b8b7b4 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\26ad01f9c002fad37427e734302383d8_e1df8f31180beed965ca2cd894b8b7b4.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\2b47c79e2e98ad8397aafbb0ffd6f673_affb20fff237be0d2ed9b6a73bceda60 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\2b47c79e2e98ad8397aafbb0ffd6f673_affb20fff237be0d2ed9b6a73bceda60.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3130b1871a126520a8c47861efe3ed4d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3130b1871a126520a8c47861efe3ed4d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_f663f250e172d75637ee387588ab955d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40e450f7ce13419a2ccc2a5445035a0a_f663f250e172d75637ee387588ab955d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\4c8f841fb02dec8c10108028db86a08d_f7f52d12b44c3bd66604e564ec47d429 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\4c8f841fb02dec8c10108028db86a08d_f7f52d12b44c3bd66604e564ec47d429.ryk
from C:\documents and settings\user\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cache\data_2 to C:\documents and settings\user\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cache\data_2.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1b1f4ba66cdbfec85a20e11bf729af23_aa85f8f9daff33153b5aec2e983b94b6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\12b9db160ad5c40a43865b2b20626f11_562b4db7e667dcc825a4240df458a240 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\12b9db160ad5c40a43865b2b20626f11_562b4db7e667dcc825a4240df458a240.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\94308059b57b3142e455b38a6eb92015 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\94308059b57b3142e455b38a6eb92015.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_d9817bd5013875ad517da73475345203.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\696f3de637e6de85b458996d49d759ad to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\696f3de637e6de85b458996d49d759ad.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7d266d9e1e69fa1eefb9699b009b34c8_ffe23a7c282c1690704b5aea6161d1b8 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7d266d9e1e69fa1eefb9699b009b34c8_ffe23a7c282c1690704b5aea6161d1b8.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_0b2fe9d8766fd21851a54da6b6f1e45d.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_28e28b4290972ff3ae54759753fb4e28 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8059e9a0d314877e40fe93d8ccfb3c69_28e28b4290972ff3ae54759753fb4e28.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\5b565e5a03c1711296156e2e5be2718c_00cf1898382336fe22c0340da9aa6678 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\5b565e5a03c1711296156e2e5be2718c_00cf1898382336fe22c0340da9aa6678.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\696f3de637e6de85b458996d49d759ad to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\696f3de637e6de85b458996d49d759ad.ryk
from C:\documents and settings\user\appdata\local\application data\application data\application data\adobe\acrobat\dc\adobesysfnt15.lst to C:\documents and settings\user\appdata\local\application data\application data\application data\adobe\acrobat\dc\adobesysfnt15.lst.ryk
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\metadata\68faf71af355126bca00ce2e73cc7374_77b682cf3aac7b00161dfff7dea4cc8c.ryk
from %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\documents\my music\sample music\albumart_{5fa05d35-a682-... to %ALLUSERSPROFILE%\application data\application data\application data\application data\application data\application data\application data\documents\my music\sample music\albumart_{5fa05d35-a682-...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\in... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\in...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\of... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\of...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_vcre... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_vcre...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_ndp4... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\dd_ndp4...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\thunderbird\... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\thunderbird\...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feeds for uni... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feeds for uni...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\sync p... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\sync p...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\wxgyhhpdzg-ed4sr0bqelbfmapgw1p... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\wxgyhhpdzg-ed4sr0bqelbfmapgw1p...
from C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\12b9db160ad5c40a43865b2b20626f11_562b4db7e667dcc825a4240df458a240 to C:\documents and settings\user\appdata\locallow\microsoft\cryptneturlcache\content\12b9db160ad5c40a43865b2b20626f11_562b4db7e667dcc825a4240df458a240.ryk
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\re1n75kr\8gc0kolxvga0p8yqaftzeevzch1b52... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\re1n75kr\8gc0kolxvga0p8yqaftzeevzch1b52...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lp... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lp...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\re1n7... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\re1n7...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\temp\temp1_fp_13.0.0.182_archive.zip\fp_13.0.0... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\temp\temp1_fp_13.0.0.182_archive.zip\fp_13.0.0...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\recovery\high\acti... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\recovery\high\acti...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5bke\mbox-contents... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5bke\mbox-contents...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\dil-contents-... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\dil-contents-...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\caasbycl\satellitelib-... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\caasbycl\satellitelib-...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\vt12abarw5hnohlt-y66pkclfe7azd... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\0u8lpyu9\vt12abarw5hnohlt-y66pkclfe7azd...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5bke\fdc5uco11re5u283tqazmjrjqbqgkv... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\<INETFILES>\content.ie5\bzjx5bke\fdc5uco11re5u283tqazmjrjqbqgkv...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\r... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\r...
from C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\microsoft .net framework... to C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\microsoft .net framework...
from C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\loading\progress_agent.gif to C:\documents and settings\user\appdata\roaming\icqm\icq\html\de\loading\progress_agent.gif.ryk

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'<LOCALNET>.42.1':445
'<LOCALNET>.42.1':139

UDP

'<LOCALNET>.42.1':7
'22#.0.0.22':7
'22#.0.0.252':7
'23#.#55.255.250':7

Miscellaneous

Creates and executes the following

'<Current directory>\dmlacte.exe' 8 LAN
'<Current directory>\dmlacte.exe' 8 LAN' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "audioendpointbuilder" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "samss" /y' (with hidden window)

Executes the following

'%WINDIR%\syswow64\net1.exe' stop "audioendpointbuilder" /y
'%WINDIR%\syswow64\net1.exe' stop "samss" /y

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial