Trojan.Encoder.38260

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%HOMEPATH%\start menu\programs\startup\i1rwde9x9.readme.txt

Creates the following files on removable media

<Drive name for removable media>:\i1rwde9x9.readme.txt
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx

Malicious functions

Injects code into

the following user processes:

2.tmp

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\application data\i1rwde9x9.ico
%TEMP%\pyl1.tmp\translations\lv\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mk\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mk\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ml\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ml\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mo\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mo\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mr\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mr\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ms\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ms\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mt\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\mt\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\my\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\lv\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\my\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\nb\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ne\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ne\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\nl\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\nl\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\nn\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\nn\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\oc\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\oc\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\pl\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\pl\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\pt\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\pt\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\nb\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\lt\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\lt\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\jv\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\hu\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\it\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\is\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\is\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\id\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\id\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\hu\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\hr\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\gu\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\hr\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\hi\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\hi\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\he\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\he\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\gu\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\it\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ja\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\jv\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ka\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ka\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\kab\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\kab\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\kk\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ro\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\kn\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ko\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ko\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ku\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ku\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ja\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\kn\lc_messages\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lv\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\kk\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ug\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\winboot\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\bg\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ca\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\cs\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\da\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\de\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\wae\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\el\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en_gb\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es_419\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\et\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fil\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hu\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\id\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\it\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ja\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ko\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\wae\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\vi\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\th\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sq\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ta\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ta\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sv\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sv\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sr\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sr\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sq\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ru\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sl\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sl\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sk\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\sk\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\shn\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\shn\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\te\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\te\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\tr\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\tr\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\tw\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\tw\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ug\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\uk\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ro\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ru\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ur\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ur\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\uz\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\uz\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\vi\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\th\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\uk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lt\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\gl\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\eo\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\packages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\hooks\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\bin\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\bin\formats\i1rwde9x9.readme.txt
%TEMP%\outlook logging\i1rwde9x9.readme.txt
%TEMP%\opera installer\i1rwde9x9.readme.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\i1rwde9x9.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\i1rwde9x9.readme.txt
%TEMP%\lilo.1120\i1rwde9x9.readme.txt
%TEMP%\hsperfdata_user\i1rwde9x9.readme.txt
%TEMP%\cprogram filesopera\i1rwde9x9.readme.txt
%TEMP%\adobe_admlogs\i1rwde9x9.readme.txt
%TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\i1rwde9x9.readme.txt
%TEMP%\2.9.0.1467 (partner)\i1rwde9x9.readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\i1rwde9x9.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\data\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\bittorrent\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\cipher\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\hash\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\publickey\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\util\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\ctypes\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\encodings\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\logging\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\msg\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\pkt\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\util\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\uk\i1rwde9x9.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\i1rwde9x9.readme.txt
unc\lzhofycsc*\mailslot\net\netlogon
C:\documents and settings\default user\start menu\programs\startup\i1rwde9x9.readme.txt
C:\documents and settings\default user\start menu\programs\accessories\i1rwde9x9.readme.txt
C:\documents and settings\default user\start menu\programs\accessories\entertainment\i1rwde9x9.readme.txt
C:\documents and settings\default user\start menu\programs\accessories\accessibility\i1rwde9x9.readme.txt
C:\documents and settings\default user\sendto\i1rwde9x9.readme.txt
C:\documents and settings\default user\recent\i1rwde9x9.readme.txt
C:\documents and settings\default user\nethood\i1rwde9x9.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\browser-region\i1rwde9x9.readme.txt
C:\documents and settings\default user\my documents\i1rwde9x9.readme.txt
C:\documents and settings\default user\local settings\i1rwde9x9.readme.txt
C:\documents and settings\default user\local settings\temp\i1rwde9x9.readme.txt
C:\documents and settings\default user\favorites\i1rwde9x9.readme.txt
C:\documents and settings\default user\desktop\i1rwde9x9.readme.txt
D:\i1rwde9x9.readme.txt
C:\documents and settings\default user\start menu\programs\i1rwde9x9.readme.txt
C:\documents and settings\default user\start menu\i1rwde9x9.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\branding\i1rwde9x9.readme.txt
%HOMEPATH%\favorites\links\i1rwde9x9.readme.txt
C:\documents and settings\default user\templates\i1rwde9x9.readme.txt
C:\documents and settings\default user\i1rwde9x9.readme.txt
%HOMEPATH%\.oracle_jre_usage\i1rwde9x9.readme.txt
%HOMEPATH%\desktop\i1rwde9x9.readme.txt
%HOMEPATH%\favorites\links\яндекс.url.i1rwde9x9
%TEMP%\pyl1.tmp\data\images\i1rwde9x9.readme.txt
%HOMEPATH%\favorites\links\почта.url.i1rwde9x9
%TEMP%\pyl1.tmp\lib\openpgp\i1rwde9x9.readme.txt
%HOMEPATH%\local settings\apps\2.0\p6vnyxmj.ahb\be8ln32k.1b1\manifests\i1rwde9x9.readme.txt
%HOMEPATH%\local settings\apps\2.0\p6vnyxmj.ahb\be8ln32k.1b1\i1rwde9x9.readme.txt
%HOMEPATH%\local settings\apps\2.0\p6vnyxmj.ahb\i1rwde9x9.readme.txt
%HOMEPATH%\local settings\apps\2.0\i1rwde9x9.readme.txt
%HOMEPATH%\local settings\apps\i1rwde9x9.readme.txt
%HOMEPATH%\favorites\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fy\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\gl\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\winui\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\da\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\da\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\de\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\de\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\el\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\el\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en_au\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en_au\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\csb\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\cy\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\csb\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\es\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\es\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\et\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\et\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\eu\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\eu\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fa\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fa\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fi\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fi\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fr\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fr\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\fy\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\eo\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\cs\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\common\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\br\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\xml\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\as\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ar\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ar\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\af\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\af\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\xml\sax\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\cy\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\xml\parsers\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\win32\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\win32\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\as\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ast\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ast\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\bg\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\bg\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\bo\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\bo\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\br\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\sets\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\bs\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\bs\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ca\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\ca\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\crh\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\crh\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\translations\cs\lc_messages\i1rwde9x9.readme.txt
%TEMP%\pyl1.tmp\lib\urlgrabber\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nb\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ru\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\th\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\tr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\uk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\vi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_cn\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_tw\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_pt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\bg\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ca\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\cs\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\da\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\de\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\el\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_gb\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_us\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es_419\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\et\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\eu\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fil\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ar\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_br\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\no\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\_locales\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_us\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_gb\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\el\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\de\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\cs\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\he\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ca\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\bg\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ar\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es_419\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\et\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\nl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hu\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fil\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\he\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\it\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ja\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ko\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\id\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\da\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\nl\i1rwde9x9.readme.txt
%TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\i1rwde9x9.readme.txt
%TEMP%\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\i1rwde9x9.readme.txt
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\i1rwde9x9.readme.txt
%TEMP%\i1rwde9x9.readme.txt
%HOMEPATH%\local settings\i1rwde9x9.readme.txt
%HOMEPATH%\my documents\downloads\i1rwde9x9.readme.txt
%HOMEPATH%\my documents\my music\i1rwde9x9.readme.txt
%HOMEPATH%\my documents\my pictures\i1rwde9x9.readme.txt
%HOMEPATH%\my documents\i1rwde9x9.readme.txt
%HOMEPATH%\nethood\i1rwde9x9.readme.txt
%HOMEPATH%\printhood\i1rwde9x9.readme.txt
%HOMEPATH%\recent\i1rwde9x9.readme.txt
%HOMEPATH%\sendto\i1rwde9x9.readme.txt
%TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\accessories\accessibility\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\accessories\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\administrative tools\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\icq\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\telegram desktop\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\winrar\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\i1rwde9x9.readme.txt
%HOMEPATH%\templates\i1rwde9x9.readme.txt
%HOMEPATH%\voip\i1rwde9x9.readme.txt
%HOMEPATH%\i1rwde9x9.readme.txt
C:\documents and settings\i1rwde9x9.readme.txt
C:\kms\i1rwde9x9.readme.txt
<Current directory>\i1rwde9x9.readme.txt
C:\i1rwde9x9.readme.txt
%HOMEPATH%\start menu\programs\accessories\entertainment\i1rwde9x9.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\i1rwde9x9.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\i1rwde9x9.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hu\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ru\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ro\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_pt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_br\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\no\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ms\i1rwde9x9.readme.txt
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ko\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ja\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\it\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\id\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sl\i1rwde9x9.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\th\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\tr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_tw\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hi\i1rwde9x9.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\i1rwde9x9.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\i1rwde9x9.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\i1rwde9x9.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\i1rwde9x9.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\browser-region\i1rwde9x9.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\branding\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ro\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_cn\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ja\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ko\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\nl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\no\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_br\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_pt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ro\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ru\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hu\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\it\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\id\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\uk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\vi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_cn\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_tw\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ar\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\bg\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ca\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\cs\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\da\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\de\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\el\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\en\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\tr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_br\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\el\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\th\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_tw\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_cn\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\vi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\uk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\tr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fil\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ru\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ro\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_pt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2064_18724\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ar\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\bg\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ca\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\cs\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\da\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\de\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\th\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\en\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\es\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fil\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\he\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\es\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\vi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\de\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\el\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\en\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\es\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fil\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hu\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\id\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\it\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ja\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ko\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ru\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\nl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\no\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_br\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_pt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ro\i1rwde9x9.readme.txt
%ALLUSERSPROFILE%\application data\i1rwde9x9.bmp
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\se\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\th\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\tr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\uk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\cs\i1rwde9x9.readme.txt
C:\documents and settings\default user\printhood\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ca\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sk\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ko\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_br\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\no\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\nl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ja\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\da\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\it\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\id\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hu\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\he\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_pt\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ro\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sl\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sv\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\th\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\tr\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\vi\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ar\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\bg\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_tw\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ru\i1rwde9x9.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_cn\i1rwde9x9.readme.txt
%ALLUSERSPROFILE%\application data\2.tmp

Deletes the following files

<SYSTEM32>\config\appevent.evt
<SYSTEM32>\config\odiag.evt
<SYSTEM32>\config\osession.evt
<SYSTEM32>\config\secevent.evt

Moves the following files

from %TEMP%\adobearm.log to %TEMP%\adobearm.log.i1rwde9x9
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.i1rwde9x9
from %TEMP%\jaureg.log to %TEMP%\jaureg.log.i1rwde9x9
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.i1rwde9x9
from %TEMP%\java_install.log to %TEMP%\java_install.log.i1rwde9x9
from %TEMP%\java_install_reg.log to %TEMP%\java_install_reg.log.i1rwde9x9
from %TEMP%\jawshtml.html to %TEMP%\jawshtml.html.i1rwde9x9
from %TEMP%\jusched.log to %TEMP%\jusched.log.i1rwde9x9
from %TEMP%\dd_xps.txt to %TEMP%\dd_xps.txt.i1rwde9x9
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.i1rwde9x9
from %TEMP%\microsoft .net framework 3.0-kb976570_20150831_175648373.html to %TEMP%\microsoft .net framework 3.0-kb976570_20150831_175648373.html.i1rwde9x9
from %TEMP%\microsoft .net framework 4.5 setup_20150820_123115526.html to %TEMP%\microsoft .net framework 4.5 setup_20150820_123115526.html.i1rwde9x9
from %TEMP%\microsoft .net framework 4.5 setup_20150831_105942303.html to %TEMP%\microsoft .net framework 4.5 setup_20150831_105942303.html.i1rwde9x9
from %TEMP%\microsoft .net framework 4.5.2 setup_20151215_221953317.html to %TEMP%\microsoft .net framework 4.5.2 setup_20151215_221953317.html.i1rwde9x9
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150820_123340645.html to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150820_123340645.html.i1rwde9x9
from %TEMP%\setupexe(201511201342324e4).log to %TEMP%\setupexe(201511201342324e4).log.i1rwde9x9
from %TEMP%\setupexe(20151215230521214).log to %TEMP%\setupexe(20151215230521214).log.i1rwde9x9
from %TEMP%\setupexe(2015121523093290).log to %TEMP%\setupexe(2015121523093290).log.i1rwde9x9
from %TEMP%\microsoft .net framework 4 setup_20150820_122814726.html to %TEMP%\microsoft .net framework 4 setup_20150820_122814726.html.i1rwde9x9
from %TEMP%\microsoft .net framework 4 setup_20150831_105924687.html to %TEMP%\microsoft .net framework 4 setup_20150831_105924687.html.i1rwde9x9
from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd_wcf_retca4a2a.txt.i1rwde9x9
from %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log.i1rwde9x9
from %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log.i1rwde9x9
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.i1rwde9x9
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.i1rwde9x9
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.i1rwde9x9
from %TEMP%\aucheck_parser.txt to %TEMP%\aucheck_parser.txt.i1rwde9x9
from %TEMP%\dd_clwireg.txt to %TEMP%\dd_clwireg.txt.i1rwde9x9
from %TEMP%\dd_depcheck_netfx20_exp_35.txt to %TEMP%\dd_depcheck_netfx20_exp_35.txt.i1rwde9x9
from %TEMP%\dd_depcheck_netfx_exp_35.txt to %TEMP%\dd_depcheck_netfx_exp_35.txt.i1rwde9x9
from %TEMP%\dd_dotnetfx20error.txt to %TEMP%\dd_dotnetfx20error.txt.i1rwde9x9
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.i1rwde9x9
from %TEMP%\dd_dotnetfx20install.txt to %TEMP%\dd_dotnetfx20install.txt.i1rwde9x9
from %TEMP%\dd_dotnetfx35install.txt to %TEMP%\dd_dotnetfx35install.txt.i1rwde9x9
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.i1rwde9x9
from %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt to %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.i1rwde9x9
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.i1rwde9x9
from %TEMP%\dd_net_framework20_setup74f9.txt to %TEMP%\dd_net_framework20_setup74f9.txt.i1rwde9x9
from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\dd_net_framework30_setup7762.txt.i1rwde9x9
from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\dd_net_framework35_msi77c4.txt.i1rwde9x9
from %TEMP%\dd_vcredist_x86_20151215221751.log to %TEMP%\dd_vcredist_x86_20151215221751.log.i1rwde9x9
from %TEMP%\dd_dotnetfx35error.txt to %TEMP%\dd_dotnetfx35error.txt.i1rwde9x9
from %TEMP%\uxeventlog.txt to %TEMP%\uxeventlog.txt.i1rwde9x9
from %TEMP%\wubi-14.04-rev286.log to %TEMP%\wubi-14.04-rev286.log.i1rwde9x9

Modifies the following files

C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\desktop.ini
%TEMP%\dd_dotnetfx35error.txt.i1rwde9x9
%TEMP%\dd_dotnetfx20install.txt.i1rwde9x9
%TEMP%\dd_dotnetfx20error.txt.i1rwde9x9
%TEMP%\dd_depcheck_netfx_exp_35.txt.i1rwde9x9
%TEMP%\dd_depcheck_netfx20_exp_35.txt.i1rwde9x9
%TEMP%\dd_clwireg.txt.i1rwde9x9
%TEMP%\aucheck_parser.txt.i1rwde9x9
%TEMP%\aspnetsetup_00000.log.i1rwde9x9
%TEMP%\aspnetsetup.log.i1rwde9x9
%TEMP%\adobesfx.log.i1rwde9x9
%TEMP%\adobearm_notlocked.log.i1rwde9x9
%TEMP%\adobearm.log.i1rwde9x9
%HOMEPATH%\templates\wordpfct.wpg.i1rwde9x9
%HOMEPATH%\templates\wordpfct.wpd.i1rwde9x9
%HOMEPATH%\templates\winword2.doc.i1rwde9x9
%HOMEPATH%\templates\winword.doc.i1rwde9x9
%HOMEPATH%\templates\sndrec.wav.i1rwde9x9
%HOMEPATH%\templates\quattro.wb2.i1rwde9x9
%HOMEPATH%\templates\presenta.shw.i1rwde9x9
%HOMEPATH%\templates\powerpnt.ppt.i1rwde9x9
%HOMEPATH%\templates\lotus.wk4.i1rwde9x9
%HOMEPATH%\templates\excel4.xls.i1rwde9x9
%HOMEPATH%\templates\excel.xls.i1rwde9x9
%HOMEPATH%\templates\amipro.sam.i1rwde9x9
%HOMEPATH%\and.i1rwde9x9
C:\documents.i1rwde9x9
C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\info2
%TEMP%\dd_dotnetfx35install.txt.i1rwde9x9
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.i1rwde9x9

Modifies multiple files.

Moves itself

from <Full path to file> to <Current directory>\aaaaaaaaaaaa
from <Current directory>\wwwwwwwwwwww to <Current directory>\xxxxxxxxxxxx
from <Current directory>\vvvvvvvvvvvv to <Current directory>\wwwwwwwwwwww
from <Current directory>\uuuuuuuuuuuu to <Current directory>\vvvvvvvvvvvv
from <Current directory>\tttttttttttt to <Current directory>\uuuuuuuuuuuu
from <Current directory>\ssssssssssss to <Current directory>\tttttttttttt
from <Current directory>\rrrrrrrrrrrr to <Current directory>\ssssssssssss
from <Current directory>\qqqqqqqqqqqq to <Current directory>\rrrrrrrrrrrr
from <Current directory>\pppppppppppp to <Current directory>\qqqqqqqqqqqq
from <Current directory>\oooooooooooo to <Current directory>\pppppppppppp
from <Current directory>\nnnnnnnnnnnn to <Current directory>\oooooooooooo
from <Current directory>\mmmmmmmmmmmm to <Current directory>\nnnnnnnnnnnn
from <Current directory>\llllllllllll to <Current directory>\mmmmmmmmmmmm
from <Current directory>\kkkkkkkkkkkk to <Current directory>\llllllllllll
from <Current directory>\jjjjjjjjjjjj to <Current directory>\kkkkkkkkkkkk
from <Current directory>\iiiiiiiiiiii to <Current directory>\jjjjjjjjjjjj
from <Current directory>\hhhhhhhhhhhh to <Current directory>\iiiiiiiiiiii
from <Current directory>\gggggggggggg to <Current directory>\hhhhhhhhhhhh
from <Current directory>\ffffffffffff to <Current directory>\gggggggggggg
from <Current directory>\eeeeeeeeeeee to <Current directory>\ffffffffffff
from <Current directory>\dddddddddddd to <Current directory>\eeeeeeeeeeee
from <Current directory>\cccccccccccc to <Current directory>\dddddddddddd
from <Current directory>\bbbbbbbbbbbb to <Current directory>\cccccccccccc
from <Current directory>\aaaaaaaaaaaa to <Current directory>\bbbbbbbbbbbb
from <Current directory>\xxxxxxxxxxxx to <Current directory>\yyyyyyyyyyyy
from <Current directory>\yyyyyyyyyyyy to <Current directory>\zzzzzzzzzzzz

Deletes itself.

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\application data\2.tmp'

Executes the following

'<SYSTEM32>\verclsid.exe' /C {2559A1F4-21D7-11D4-BDAF-00C04F60B9F0} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
'<SYSTEM32>\verclsid.exe' /C {2559A1F5-21D7-11D4-BDAF-00C04F60B9F0} /I {000214E6-0000-0000-C000-000000000046} /X 0x401

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial