Trojan.Encoder.29900

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Realtek HD Audio' = 'C:\ProgramData\RealtekHD\taskhostw.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sNpEShi30R' = 'C:\ProgramData\install\svhost.exe'

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\startup\wp5i6thvjf-readme.txt

Creates the following files on removable media

<Drive name for removable media>:\wp5i6thvjf-readme.txt
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\indogerman2010.pptx

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

blocks the following features:

User Account Control (UAC)

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'

deletes volume shadow copies.

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] 'C:\Programdata' = 'System'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>' = 'SystemHD'

Reads files which store third party applications passwords

%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\toolbar.bmp

Modifies file system

Creates the following files

C:\programdata\microsoft\check\check.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_br\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_pt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ro\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ru\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\se\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\th\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\tr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\uk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\vi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_cn\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_tw\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\_locales\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ar\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\bg\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ca\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\no\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\cs\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\nl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ar\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\bg\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ca\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\cs\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\da\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\de\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\el\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\en\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\es\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fil\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hu\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\id\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\it\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ja\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ko\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\da\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\de\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\el\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ru\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\th\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\tr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\uk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_gb\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\vi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_tw\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ar\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\bg\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ca\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\cs\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\da\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\de\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\el\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_pt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ro\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_br\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\no\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_gb\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_us\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es_419\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\et\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fil\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\he\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hu\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\id\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\it\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ja\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ko\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\nl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_cn\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_tw\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ro\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\et\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fil\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hu\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\id\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\it\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ja\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ko\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nb\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_br\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_pt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ro\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es_419\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ru\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\te\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\th\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\tr\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\tw\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ug\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\uk\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ur\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\uz\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\vi\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\wae\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\bg\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ca\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\cs\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\da\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\de\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\el\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en_gb\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ja\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ko\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\nl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\no\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_br\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\vi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_pt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ru\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\th\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\tr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\uk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\id\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\it\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hu\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\th\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\tr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\uk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\vi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_cn\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_tw\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ar\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\bg\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_cn\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\cs\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ca\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\de\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\el\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\en\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\es\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fil\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\he\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\da\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_us\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es_419\wp5i6thvjf-readme.txt
C:\programdata\rundll\etchcore-0.x64.dll
C:\programdata\rundll\etchcore-0.x86.dll
C:\programdata\rundll\eteb-2.dll
C:\programdata\rundll\etebcore-2.x64.dll
C:\programdata\rundll\etebcore-2.x86.dll
C:\programdata\rundll\eternalblue-2.2.0.exe
C:\programdata\rundll\eternalblue-2.2.0.fb
C:\programdata\rundll\eternalblue-2.2.0.skeleton.xml
C:\programdata\rundll\mfc140enu.dll
C:\programdata\rundll\eternalblue-2.2.0.xml
C:\programdata\rundll\exma-1.dll
C:\programdata\rundll\iconv.dll
C:\programdata\rundll\libcurl.dll
C:\programdata\rundll\libeay32.dll
C:\programdata\rundll\libiconv-2.dll
C:\programdata\rundll\libxml2.dll
C:\programdata\rundll\mfc140chs.dll
C:\programdata\rundll\mfc140cht.dll
C:\programdata\rundll\esco-0.dll
C:\programdata\rundll\etch-0.dll
C:\programdata\rundll\exma.dll
C:\programdata\rundll\mfc140deu.dll
C:\programdata\rundll\doublepulsar-1.3.1.exe
C:\programdata\rundll\api-ms-win-crt-math-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-multibyte-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-private-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-process-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-runtime-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-stdio-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-string-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-time-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-utility-l1-1-0.dll
C:\programdata\rundll\api-ms-win-eventing-provider-l1-1-0.dll
C:\programdata\rundll\cnli-0.dll
C:\programdata\rundll\cnli-1.dll
C:\programdata\rundll\coli-0.dll
C:\programdata\rundll\concrt140.dll
C:\programdata\rundll\crli-0.dll
C:\programdata\rundll\dmgd-1.dll
C:\programdata\rundll\dmgd-4.dll
C:\programdata\rundll\doublepulsar-1.3.1.skeleton.xml
C:\programdata\rundll\api-ms-win-crt-heap-l1-1-0.dll
C:\programdata\rundll\doublepulsar-1.3.1.xml
C:\programdata\rundll\2x64.dll
C:\programdata\rundll\mfc140esn.dll
C:\programdata\rundll\trch.dll
C:\programdata\rundll\trch-1.dll
C:\programdata\rundll\trfo.dll
C:\programdata\rundll\trfo-0.dll
C:\programdata\rundll\trfo-2.dll
C:\programdata\rundll\tucl.dll
C:\programdata\rundll\tucl-1.dll
C:\programdata\rundll\ucl.dll
C:\programdata\rundll\ucrtbase.dll
C:\programdata\rundll\mfc140fra.dll
C:\programdata\rundll\vcamp140.dll
C:\programdata\rundll\vcomp140.dll
C:\programdata\rundll\vcruntime140.dll
C:\programdata\rundll\x64.dll
C:\programdata\rundll\x86.dll
C:\programdata\rundll\xdvl-0.dll
C:\programdata\rundll\zibe.dll
C:\programdata\rundll\zlib1.dll
C:\programdata\rundll\tibe-2.dll
C:\programdata\rundll\tibe-1.dll
C:\programdata\rundll\trch-0.dll
C:\programdata\rundll\tibe.dll
C:\programdata\rundll\system.exe
C:\programdata\rundll\mfc140ita.dll
C:\programdata\rundll\mfc140kor.dll
C:\programdata\rundll\mfc140rus.dll
C:\programdata\rundll\mfcm140.dll
C:\programdata\rundll\mfcm140u.dll
C:\programdata\rundll\msvcp140.dll
C:\programdata\rundll\pcla-0.dll
C:\programdata\rundll\pcre-0.dll
C:\programdata\rundll\api-ms-win-crt-filesystem-l1-1-0.dll
C:\programdata\rundll\pcrecpp-0.dll
C:\programdata\rundll\api-ms-win-crt-locale-l1-1-0.dll
C:\programdata\rundll\posh.dll
C:\programdata\rundll\riar.dll
C:\programdata\rundll\riar-2.dll
C:\programdata\rundll\rundll.exe
C:\programdata\rundll\scan.txt
C:\programdata\rundll\ssleay32.dll
C:\programdata\rundll\start.exe
C:\programdata\rundll\start.vbs
C:\programdata\rundll\pcreposix-0.dll
C:\programdata\rundll\mfc140jpn.dll
C:\programdata\rundll\posh-0.dll
C:\programdata\rundll\api-ms-win-crt-environment-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-convert-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\th\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\tr\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\wp5i6thvjf-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\branding\wp5i6thvjf-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\browser-region\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\msg\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\pkt\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\util\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\common\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\win32\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\win32\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ar\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\bg\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ca\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\cs\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ro\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ru\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_pt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\it\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\eu\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fil\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\he\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hu\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\da\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ta\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\id\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ko\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ms\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\nl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\no\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_br\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\et\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ja\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ja\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\de\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\tr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\uk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\vi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_cn\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_tw\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\branding\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\browser-region\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sl\wp5i6thvjf-readme.txt
D:\wp5i6thvjf-readme.txt
C:\programdata\rundll\adfw-2.dll
C:\programdata\rundll\api-ms-win-core-file-l1-2-0.dll
C:\programdata\rundll\api-ms-win-core-file-l2-1-0.dll
C:\programdata\rundll\api-ms-win-core-localization-l1-2-0.dll
C:\programdata\rundll\api-ms-win-core-processthreads-l1-1-1.dll
C:\programdata\rundll\api-ms-win-core-synch-l1-2-0.dll
C:\programdata\rundll\api-ms-win-core-timezone-l1-1-0.dll
C:\programdata\rundll\api-ms-win-core-xstate-l2-1-0.dll
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sr\wp5i6thvjf-readme.txt
C:\programdata\rundll\adfw.dll
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\th\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sk\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fil\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\he\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hi\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hr\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hu\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\id\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\el\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\it\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\en\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ko\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lv\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\nl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\no\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pl\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_br\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_pt\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ro\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\es\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ru\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lt\wp5i6thvjf-readme.txt
C:\programdata\rundll\vccorlib140.dll
%TEMP%\pyl1.tmp\translations\sv\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\pl\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\wp5i6thvjf-readme.txt
%TEMP%\<INETFILES>\wp5i6thvjf-readme.txt
%TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\wp5i6thvjf-readme.txt
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\wp5i6thvjf-readme.txt
%TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\wp5i6thvjf-readme.txt
%TEMP%\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\wp5i6thvjf-readme.txt
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.ie5\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.mra.images\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.mso\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.word\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\accessories\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\administrative tools\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\icq\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\telegram desktop\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\winrar\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\wp5i6thvjf-readme.txt
%TEMP%\outlook logging\wp5i6thvjf-readme.txt
C:\documents and settings\default user\start menu\programs\startup\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\history\history.ie5\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\history\history.ie5\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\wp5i6thvjf-readme.txt
%HOMEPATH%\favorites\links\почта.url
%HOMEPATH%\favorites\links\яндекс.url
%HOMEPATH%\local settings\history\history.ie5\wp5i6thvjf-readme.txt
%TEMP%\2.9.0.1467 (partner)\wp5i6thvjf-readme.txt
%TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\wp5i6thvjf-readme.txt
%TEMP%\adobe_admlogs\wp5i6thvjf-readme.txt
%TEMP%\cookies\wp5i6thvjf-readme.txt
%TEMP%\history\wp5i6thvjf-readme.txt
%TEMP%\hsperfdata_user\wp5i6thvjf-readme.txt
%TEMP%\lilo.1120\wp5i6thvjf-readme.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\wp5i6thvjf-readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\wp5i6thvjf-readme.txt
C:\programdata\windowstask\scaner.dat
%TEMP%\opera installer\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\communications\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\wp5i6thvjf-readme.txt
%TEMP%\<INETFILES>\content.ie5\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\bittorrent\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.ie5\ee7gwdg8\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.ie5\h8mbgrq8\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.ie5\z9pmdpek\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\accessories\accessibility\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\accessories\entertainment\wp5i6thvjf-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\bin\formats\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\data\images\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\winboot\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\data\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\bin\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\system tools\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ee7gwdg8\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\etuaii8e\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\h8mbgrq8\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\z9pmdpek\wp5i6thvjf-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\accessibility\wp5i6thvjf-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\entertainment\wp5i6thvjf-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\history\history.ie5\mshist012017042620170427\wp5i6thvjf-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\wp5i6thvjf-readme.txt
%TEMP%\history\history.ie5\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\wp5i6thvjf-readme.txt
C:\documents and settings\default user\favorites\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\wp5i6thvjf-readme.txt
C:\documents and settings\default user\my documents\wp5i6thvjf-readme.txt
C:\documents and settings\default user\nethood\wp5i6thvjf-readme.txt
C:\documents and settings\default user\printhood\wp5i6thvjf-readme.txt
C:\documents and settings\default user\recent\wp5i6thvjf-readme.txt
C:\documents and settings\default user\sendto\wp5i6thvjf-readme.txt
C:\documents and settings\default user\start menu\wp5i6thvjf-readme.txt
C:\documents and settings\default user\templates\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\cookies\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\cookies\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\wp5i6thvjf-readme.txt
%HOMEPATH%\.oracle_jre_usage\wp5i6thvjf-readme.txt
%HOMEPATH%\cookies\wp5i6thvjf-readme.txt
%HOMEPATH%\desktop\wp5i6thvjf-readme.txt
%HOMEPATH%\favorites\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\wp5i6thvjf-readme.txt
%HOMEPATH%\my documents\wp5i6thvjf-readme.txt
C:\documents and settings\default user\desktop\wp5i6thvjf-readme.txt
%HOMEPATH%\nethood\wp5i6thvjf-readme.txt
C:\documents and settings\default user\cookies\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\wp5i6thvjf-readme.txt
%TEMP%\aut1.tmp
C:\programdata\realtekhd\taskhostw.exe
%TEMP%\aut2.tmp
C:\programdata\install\svhost.exe
C:\wp5i6thvjf-readme.txt
C:\documents and settings\wp5i6thvjf-readme.txt
%ProgramFiles%\wp5i6thvjf-readme.txt
C:\recycler\wp5i6thvjf-readme.txt
<Current directory>\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\wp5i6thvjf-readme.txt
C:\documents and settings\default user\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\wp5i6thvjf-readme.txt
%HOMEPATH%\wp5i6thvjf-readme.txt
C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\desktop\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\drm\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\favorites\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\templates\wp5i6thvjf-readme.txt
%HOMEPATH%\printhood\wp5i6thvjf-readme.txt
%HOMEPATH%\recent\wp5i6thvjf-readme.txt
%HOMEPATH%\sendto\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\programs\wp5i6thvjf-readme.txt
%HOMEPATH%\userdata\09upir0l\wp5i6thvjf-readme.txt
%HOMEPATH%\userdata\e3unqlkn\wp5i6thvjf-readme.txt
%HOMEPATH%\userdata\inafedwn\wp5i6thvjf-readme.txt
%HOMEPATH%\userdata\ubghkdcj\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my music\my playlists\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample music\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\winrar\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\administrative tools\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\games\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\google chrome\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\mirc\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\qip 2012\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\steam\wp5i6thvjf-readme.txt
%HOMEPATH%\my documents\my music\wp5i6thvjf-readme.txt
%HOMEPATH%\my documents\my pictures\wp5i6thvjf-readme.txt
%HOMEPATH%\my documents\downloads\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\<INETFILES>\wp5i6thvjf-readme.txt
%TEMP%\wp5i6thvjf-readme.txt
%HOMEPATH%\templates\wp5i6thvjf-readme.txt
%HOMEPATH%\userdata\wp5i6thvjf-readme.txt
%HOMEPATH%\voip\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my music\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my pictures\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\documents\my videos\wp5i6thvjf-readme.txt
%ALLUSERSPROFILE%\start menu\programs\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\history\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\history\history.ie5\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\wp5i6thvjf-readme.txt
C:\documents and settings\default user\local settings\temp\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\history\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\temp\wp5i6thvjf-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\history\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\temp\wp5i6thvjf-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\wp5i6thvjf-readme.txt
%HOMEPATH%\favorites\links\wp5i6thvjf-readme.txt
%HOMEPATH%\local settings\history\wp5i6thvjf-readme.txt
%HOMEPATH%\start menu\wp5i6thvjf-readme.txt
C:\documents and settings\default user\start menu\programs\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\ctypes\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\encodings\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\as\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ast\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\bg\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\bo\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\br\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\bs\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ca\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\crh\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\es\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\cs\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\cy\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\da\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\de\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\el\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en_au\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\af\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ar\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\csb\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\eo\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\wp5i6thvjf-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\wp5i6thvjf-readme.txt
%TEMP%\<INETFILES>\content.ie5\4xoboj8j\wp5i6thvjf-readme.txt
%TEMP%\<INETFILES>\content.ie5\chyzclen\wp5i6thvjf-readme.txt
%TEMP%\<INETFILES>\content.ie5\g1qjk5mv\wp5i6thvjf-readme.txt
%TEMP%\<INETFILES>\content.ie5\ibwpozo7\wp5i6thvjf-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\hooks\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\packages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\cipher\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\hash\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\publickey\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\util\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\xml\parsers\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\xml\sax\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sq\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\et\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ml\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mr\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ms\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mt\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\my\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\nb\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ne\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\nl\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\nn\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\eu\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\oc\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\pt\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ro\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ru\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\shn\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sk\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sl\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mk\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\lv\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mo\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\lt\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ku\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fa\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fr\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fy\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\gl\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\gu\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\he\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\hi\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\hr\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\hu\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\is\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ja\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\jv\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ka\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\kab\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\kk\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\kn\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ko\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\id\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fi\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\it\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\wp5i6thvjf-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\eo\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\es\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\et\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\eu\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fa\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fi\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fr\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\fy\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\gl\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\gu\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\he\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\hi\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\hr\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\hu\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\id\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\is\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\de\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\el\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\da\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ast\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\sets\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\urlgrabber\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\winui\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\xml\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\af\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ar\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\it\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sr\lc_messages\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\as\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\bo\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\br\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\bs\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ca\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\crh\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\cs\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\csb\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\cy\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\lib\logging\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\bg\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mr\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ja\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\kk\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sl\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sq\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sr\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sv\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ta\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\te\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\th\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\en_au\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\tr\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ug\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\uk\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ur\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\uz\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\vi\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\wae\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ru\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\tw\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\sk\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\shn\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ro\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\kn\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ko\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ku\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\lt\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\lv\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mk\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ml\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\jv\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mo\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ka\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ms\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\my\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\nb\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\ne\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\nl\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\nn\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\oc\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\pl\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\kab\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\pt\wp5i6thvjf-readme.txt
%TEMP%\pyl1.tmp\translations\mt\wp5i6thvjf-readme.txt
C:\programdata\rundll\2x86.dll

Sets the 'hidden' attribute to the following files

C:\programdata\windowstask\scaner.dat
C:\programdata\rundll\riar-2.dll
C:\programdata\rundll\posh.dll
C:\programdata\rundll\posh-0.dll
C:\programdata\rundll\pcreposix-0.dll
C:\programdata\rundll\pcrecpp-0.dll
C:\programdata\rundll\pcre-0.dll
C:\programdata\rundll\pcla-0.dll
C:\programdata\rundll\msvcp140.dll
C:\programdata\rundll\mfcm140u.dll
C:\programdata\rundll\mfcm140.dll
C:\programdata\rundll\rundll.exe
C:\programdata\rundll\riar.dll
C:\programdata\rundll\mfc140jpn.dll
C:\programdata\rundll\mfc140ita.dll
C:\programdata\rundll\mfc140fra.dll
C:\programdata\rundll\mfc140esn.dll
C:\programdata\rundll\mfc140enu.dll
C:\programdata\rundll\mfc140deu.dll
C:\programdata\rundll\mfc140cht.dll
C:\programdata\rundll\mfc140chs.dll
C:\programdata\rundll\libxml2.dll
C:\programdata\rundll\libiconv-2.dll
C:\programdata\rundll\mfc140rus.dll
C:\programdata\rundll\api-ms-win-crt-time-l1-1-0.dll
C:\programdata\rundll\scan.txt
C:\programdata\rundll\xdvl-0.dll
C:\programdata\rundll\x86.dll
C:\programdata\rundll\x64.dll
C:\programdata\rundll\vcruntime140.dll
C:\programdata\rundll\vcomp140.dll
C:\programdata\rundll\vccorlib140.dll
C:\programdata\rundll\vcamp140.dll
C:\programdata\rundll\ucrtbase.dll
C:\programdata\rundll\ucl.dll
C:\programdata\rundll\tucl.dll
C:\programdata\rundll\tucl-1.dll
C:\programdata\rundll\trfo.dll
C:\programdata\rundll\trfo-2.dll
C:\programdata\rundll\trfo-0.dll
C:\programdata\rundll\trch.dll
C:\programdata\rundll\trch-1.dll
C:\programdata\rundll\trch-0.dll
C:\programdata\rundll\tibe.dll
C:\programdata\rundll\tibe-2.dll
C:\programdata\rundll\tibe-1.dll
C:\programdata\rundll\system.exe
C:\programdata\rundll\start.vbs
C:\programdata\rundll\start.exe
C:\programdata\rundll\libeay32.dll
C:\programdata\rundll\mfc140kor.dll
C:\programdata\rundll\libcurl.dll
C:\programdata\rundll\iconv.dll
C:\programdata\rundll\exma.dll
C:\programdata\rundll\api-ms-win-core-xstate-l2-1-0.dll
C:\programdata\rundll\api-ms-win-crt-process-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-private-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-multibyte-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-math-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-locale-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-heap-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-filesystem-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-environment-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-convert-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-conio-l1-1-0.dll
C:\programdata\rundll\api-ms-win-core-timezone-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-stdio-l1-1-0.dll
C:\programdata\rundll\api-ms-win-core-synch-l1-2-0.dll
C:\programdata\rundll\api-ms-win-core-processthreads-l1-1-1.dll
C:\programdata\rundll\api-ms-win-core-localization-l1-2-0.dll
C:\programdata\rundll\api-ms-win-core-file-l2-1-0.dll
C:\programdata\rundll\api-ms-win-core-file-l1-2-0.dll
C:\programdata\rundll\adfw.dll
C:\programdata\rundll\adfw-2.dll
C:\programdata\rundll\2x86.dll
C:\programdata\rundll\2x64.dll
C:\programdata\windowstask\scaner.exe
C:\programdata\rundll\zibe.dll
C:\programdata\rundll\ssleay32.dll
C:\programdata\rundll\api-ms-win-crt-string-l1-1-0.dll
C:\programdata\rundll\api-ms-win-eventing-provider-l1-1-0.dll
C:\programdata\rundll\api-ms-win-crt-runtime-l1-1-0.dll
C:\programdata\rundll\exma-1.dll
C:\programdata\rundll\eternalblue-2.2.0.xml
C:\programdata\rundll\eternalblue-2.2.0.skeleton.xml
C:\programdata\rundll\eternalblue-2.2.0.fb
C:\programdata\rundll\eternalblue-2.2.0.exe
C:\programdata\rundll\etebcore-2.x86.dll
C:\programdata\rundll\etebcore-2.x64.dll
C:\programdata\rundll\eteb-2.dll
C:\programdata\rundll\etchcore-0.x86.dll
C:\programdata\rundll\etchcore-0.x64.dll
C:\programdata\rundll\etch-0.dll
C:\programdata\rundll\esco-0.dll
C:\programdata\rundll\doublepulsar-1.3.1.xml
C:\programdata\rundll\doublepulsar-1.3.1.skeleton.xml
C:\programdata\rundll\doublepulsar-1.3.1.exe
C:\programdata\rundll\dmgd-4.dll
C:\programdata\rundll\dmgd-1.dll
C:\programdata\rundll\crli-0.dll
C:\programdata\rundll\concrt140.dll
C:\programdata\rundll\coli-0.dll
C:\programdata\rundll\cnli-1.dll
C:\programdata\rundll\cnli-0.dll
C:\programdata\rundll\api-ms-win-crt-utility-l1-1-0.dll
C:\programdata\rundll\zlib1.dll

Deletes the following files

%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
C:\programdata\windowstask\scaner.exe

Moves the following files

from %HOMEPATH%\favorites\links\почта.url to %HOMEPATH%\favorites\links\почта.url.wp5i6thvjf
from %TEMP%\jaureg.log to %TEMP%\jaureg.log.wp5i6thvjf
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.wp5i6thvjf
from %TEMP%\dd_vcredist_x86_20151215221751.log to %TEMP%\dd_vcredist_x86_20151215221751.log.wp5i6thvjf
from %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log.wp5i6thvjf
from %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log.wp5i6thvjf
from %TEMP%\dd_xps.txt to %TEMP%\dd_xps.txt.wp5i6thvjf
from %TEMP%\java_install.log to %TEMP%\java_install.log.wp5i6thvjf
from %TEMP%\jusched.log to %TEMP%\jusched.log.wp5i6thvjf
from %TEMP%\wubi-14.04-rev286.log to %TEMP%\wubi-14.04-rev286.log.wp5i6thvjf
from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\dd_net_framework30_setup7762.txt.wp5i6thvjf
from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\dd_net_framework35_msi77c4.txt.wp5i6thvjf
from %TEMP%\dd_net_framework20_setup74f9.txt to %TEMP%\dd_net_framework20_setup74f9.txt.wp5i6thvjf
from %TEMP%\setupexe(201511201342324e4).log to %TEMP%\setupexe(201511201342324e4).log.wp5i6thvjf
from %TEMP%\setupexe(20151215230521214).log to %TEMP%\setupexe(20151215230521214).log.wp5i6thvjf
from %TEMP%\setupexe(2015121523093290).log to %TEMP%\setupexe(2015121523093290).log.wp5i6thvjf
from %TEMP%\uxeventlog.txt to %TEMP%\uxeventlog.txt.wp5i6thvjf
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.wp5i6thvjf
from %TEMP%\java_install_reg.log to %TEMP%\java_install_reg.log.wp5i6thvjf
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.wp5i6thvjf
from %TEMP%\dd_clwireg.txt to %TEMP%\dd_clwireg.txt.wp5i6thvjf
from %HOMEPATH%\favorites\links\яндекс.url to %HOMEPATH%\favorites\links\яндекс.url.wp5i6thvjf
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.wp5i6thvjf
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.wp5i6thvjf
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.wp5i6thvjf
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.wp5i6thvjf
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.wp5i6thvjf
from %TEMP%\aucheck_parser.txt to %TEMP%\aucheck_parser.txt.wp5i6thvjf
from %TEMP%\dd_depcheck_netfx20_exp_35.txt to %TEMP%\dd_depcheck_netfx20_exp_35.txt.wp5i6thvjf
from %TEMP%\dd_dotnetfx35install.txt to %TEMP%\dd_dotnetfx35install.txt.wp5i6thvjf
from %TEMP%\dd_dotnetfx20error.txt to %TEMP%\dd_dotnetfx20error.txt.wp5i6thvjf
from %TEMP%\dd_dotnetfx20install.txt to %TEMP%\dd_dotnetfx20install.txt.wp5i6thvjf
from %TEMP%\dd_depcheck_netfx_exp_35.txt to %TEMP%\dd_depcheck_netfx_exp_35.txt.wp5i6thvjf
from %TEMP%\dd_dotnetfx35error.txt to %TEMP%\dd_dotnetfx35error.txt.wp5i6thvjf
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.wp5i6thvjf
from %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt to %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.wp5i6thvjf
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.wp5i6thvjf
from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd_wcf_retca4a2a.txt.wp5i6thvjf
from C:\programdata\windowstask\scaner.dat to C:\programdata\windowstask\scaner.exe

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'18#.#76.27.182':12482
'18#.#76.27.182':12020

UDP

DNS ASK ip###ger.org

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'C:\programdata\install\svhost.exe'
'C:\programdata\realtekhd\taskhostw.exe'
'C:\programdata\windowstask\scaner.exe' -pnaxui
'C:\programdata\rundll\start.exe'
'<SYSTEM32>\wscript.exe' "C:\Programdata\RunDLL\start.vbs"
'C:\programdata\rundll\rundll.exe'
'<SYSTEM32>\cmd.exe' /c sc delete swprv' (with hidden window)
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
'<SYSTEM32>\cmd.exe' /c Rundll.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "system.exe TCP 192.168.1.1 445 150 /save"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c sc delete swprv
'<SYSTEM32>\sc.exe' delete swprv
'<SYSTEM32>\verclsid.exe' /C {B5A7F190-DDA6-4420-B3BA-52453494E6CD} /I {00000000-0000-0000-C000-000000000046} /X 0x401
'<SYSTEM32>\verclsid.exe' /C {6C467336-8281-4E60-8204-430CED96822D} /I {000214E8-0000-0000-C000-000000000046} /X 0x401
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c Rundll.exe
'<SYSTEM32>\cmd.exe' /c "system.exe TCP 192.168.1.1 445 150 /save"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial