Trojan.Encoder.38388

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%HOMEPATH%\start menu\programs\startup\1ywr2c1yk.readme.txt

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\1ywr2c1yk.readme.txt
<Имя диска съемного носителя>:\middaugh_keynote.pptx
<Имя диска съемного носителя>:\asaprojectcompetition.pptx
<Имя диска съемного носителя>:\waterresourcesag.pptx
<Имя диска съемного носителя>:\hypothyroidism_slides.pptx
<Имя диска съемного носителя>:\stoc13_ml_quoc_le.pptx
<Имя диска съемного носителя>:\samieee_obiee_presentation.pptx

Вредоносные функции

Внедряет код в

следующие пользовательские процессы:

2.tmp

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\2.jpg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\13.jpg
%HOMEPATH%\desktop\13.jpeg
%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\trivial-merge.html

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\application data\1ywr2c1yk.ico
%TEMP%\pyl1.tmp\translations\lv\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mk\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mk\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ml\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ml\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mo\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mo\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mr\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mr\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ms\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ms\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mt\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\mt\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\my\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\lv\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\my\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\nb\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ne\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ne\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\nl\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\nl\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\nn\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\nn\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\oc\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\oc\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\pl\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\pl\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\pt\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\pt\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\nb\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\lt\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\lt\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\jv\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\hu\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\it\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\is\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\is\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\id\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\id\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\hu\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\hr\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\gu\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\hr\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\hi\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\hi\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\he\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\he\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\gu\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\it\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ja\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\jv\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ka\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ka\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\kab\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\kab\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\kk\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ro\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\kn\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ko\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ko\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ku\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ku\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ja\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\kn\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lv\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\kk\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ug\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\winboot\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\bg\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ca\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\cs\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\da\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\de\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\wae\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\el\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en_gb\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es_419\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\et\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fil\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hu\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\id\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\it\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ja\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ko\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\wae\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\vi\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\th\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sq\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ta\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ta\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sv\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sv\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sr\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sr\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sq\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ru\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sl\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sl\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sk\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\sk\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\shn\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\shn\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\te\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\te\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\tr\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\tr\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\tw\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\tw\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ug\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\uk\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ro\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ru\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ur\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ur\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\uz\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\uz\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\vi\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\th\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\uk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lt\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\gl\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\eo\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\packages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\hooks\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\bin\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\bin\formats\1ywr2c1yk.readme.txt
%TEMP%\outlook logging\1ywr2c1yk.readme.txt
%TEMP%\opera installer\1ywr2c1yk.readme.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\1ywr2c1yk.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\1ywr2c1yk.readme.txt
%TEMP%\lilo.1120\1ywr2c1yk.readme.txt
%TEMP%\hsperfdata_user\1ywr2c1yk.readme.txt
%TEMP%\cprogram filesopera\1ywr2c1yk.readme.txt
%TEMP%\adobe_admlogs\1ywr2c1yk.readme.txt
%TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\1ywr2c1yk.readme.txt
%TEMP%\2.9.0.1467 (partner)\1ywr2c1yk.readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\1ywr2c1yk.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\data\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\bittorrent\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\cipher\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\hash\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\publickey\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\util\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\crypto\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\ctypes\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\encodings\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\logging\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\msg\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\pkt\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\util\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\uk\1ywr2c1yk.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\1ywr2c1yk.readme.txt
unc\tghiwao*\mailslot\net\netlogon
C:\documents and settings\default user\start menu\programs\startup\1ywr2c1yk.readme.txt
C:\documents and settings\default user\start menu\programs\accessories\1ywr2c1yk.readme.txt
C:\documents and settings\default user\start menu\programs\accessories\entertainment\1ywr2c1yk.readme.txt
C:\documents and settings\default user\start menu\programs\accessories\accessibility\1ywr2c1yk.readme.txt
C:\documents and settings\default user\sendto\1ywr2c1yk.readme.txt
C:\documents and settings\default user\recent\1ywr2c1yk.readme.txt
C:\documents and settings\default user\nethood\1ywr2c1yk.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\browser-region\1ywr2c1yk.readme.txt
C:\documents and settings\default user\my documents\1ywr2c1yk.readme.txt
C:\documents and settings\default user\local settings\1ywr2c1yk.readme.txt
C:\documents and settings\default user\local settings\temp\1ywr2c1yk.readme.txt
C:\documents and settings\default user\favorites\1ywr2c1yk.readme.txt
C:\documents and settings\default user\desktop\1ywr2c1yk.readme.txt
D:\1ywr2c1yk.readme.txt
C:\documents and settings\default user\start menu\programs\1ywr2c1yk.readme.txt
C:\documents and settings\default user\start menu\1ywr2c1yk.readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\branding\1ywr2c1yk.readme.txt
%HOMEPATH%\favorites\links\1ywr2c1yk.readme.txt
C:\documents and settings\default user\templates\1ywr2c1yk.readme.txt
C:\documents and settings\default user\1ywr2c1yk.readme.txt
%HOMEPATH%\.oracle_jre_usage\1ywr2c1yk.readme.txt
%HOMEPATH%\favorites\links\яндекс.url.1ywr2c1yk
%HOMEPATH%\desktop\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\data\images\1ywr2c1yk.readme.txt
%HOMEPATH%\favorites\links\почта.url.1ywr2c1yk
%TEMP%\pyl1.tmp\lib\openpgp\1ywr2c1yk.readme.txt
%HOMEPATH%\local settings\apps\2.0\p6vnyxmj.ahb\be8ln32k.1b1\manifests\1ywr2c1yk.readme.txt
%HOMEPATH%\local settings\apps\2.0\p6vnyxmj.ahb\be8ln32k.1b1\1ywr2c1yk.readme.txt
%HOMEPATH%\local settings\apps\2.0\p6vnyxmj.ahb\1ywr2c1yk.readme.txt
%HOMEPATH%\local settings\apps\2.0\1ywr2c1yk.readme.txt
%HOMEPATH%\local settings\apps\1ywr2c1yk.readme.txt
%HOMEPATH%\favorites\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fy\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\gl\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\winui\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\da\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\da\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\de\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\de\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\el\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\el\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en_au\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en_au\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\csb\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\cy\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\csb\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\es\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\es\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\et\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\et\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\eu\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\eu\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fa\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fa\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fi\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fi\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fr\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fr\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\fy\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\eo\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\cs\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\common\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\br\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\xml\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\as\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ar\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ar\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\af\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\af\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\xml\sax\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\cy\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\xml\parsers\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\win32\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\win32\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\as\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ast\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ast\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\bg\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\bg\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\bo\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\bo\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\br\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\sets\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\bs\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\bs\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ca\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\ca\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\crh\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\crh\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\translations\cs\lc_messages\1ywr2c1yk.readme.txt
%TEMP%\pyl1.tmp\lib\urlgrabber\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nb\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ru\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\th\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\tr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\uk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\vi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_cn\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_tw\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_pt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\bg\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ca\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\cs\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\da\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\de\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\el\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_gb\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_us\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es_419\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\et\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\eu\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fil\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ar\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_br\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\no\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\_locales\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_us\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_gb\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\el\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\de\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\cs\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\he\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ca\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\bg\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ar\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es_419\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\et\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\nl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hu\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fil\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\he\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\it\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ja\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ko\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\id\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\da\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\nl\1ywr2c1yk.readme.txt
%TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\1ywr2c1yk.readme.txt
%TEMP%\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\1ywr2c1yk.readme.txt
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\1ywr2c1yk.readme.txt
%TEMP%\1ywr2c1yk.readme.txt
%HOMEPATH%\local settings\1ywr2c1yk.readme.txt
%HOMEPATH%\my documents\downloads\1ywr2c1yk.readme.txt
%HOMEPATH%\my documents\my music\1ywr2c1yk.readme.txt
%HOMEPATH%\my documents\my pictures\1ywr2c1yk.readme.txt
%HOMEPATH%\my documents\1ywr2c1yk.readme.txt
%HOMEPATH%\nethood\1ywr2c1yk.readme.txt
%HOMEPATH%\printhood\1ywr2c1yk.readme.txt
%HOMEPATH%\recent\1ywr2c1yk.readme.txt
%HOMEPATH%\sendto\1ywr2c1yk.readme.txt
%TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\accessories\accessibility\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\accessories\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\administrative tools\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\icq\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\telegram desktop\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\winrar\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\1ywr2c1yk.readme.txt
%HOMEPATH%\templates\1ywr2c1yk.readme.txt
%HOMEPATH%\voip\1ywr2c1yk.readme.txt
%HOMEPATH%\1ywr2c1yk.readme.txt
C:\documents and settings\1ywr2c1yk.readme.txt
C:\kms\1ywr2c1yk.readme.txt
<Текущая директория>\1ywr2c1yk.readme.txt
C:\1ywr2c1yk.readme.txt
%HOMEPATH%\start menu\programs\accessories\entertainment\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hu\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ru\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ro\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_pt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_br\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\no\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ms\1ywr2c1yk.readme.txt
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ko\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ja\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\it\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\id\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sl\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\th\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\tr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_tw\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hi\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\browser-region\1ywr2c1yk.readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\branding\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ro\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_cn\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ja\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ko\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\nl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\no\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_br\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_pt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ro\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ru\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hu\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\it\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\id\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\uk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\vi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_cn\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_tw\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ar\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\bg\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ca\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\cs\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\da\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\de\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\el\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\en\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\tr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_br\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\el\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\th\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_tw\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_cn\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\vi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\uk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\tr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fil\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ru\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ro\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_pt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2064_18724\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ar\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\bg\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ca\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\cs\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\da\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\de\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\th\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\en\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\es\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fil\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\he\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\es\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\vi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\de\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\el\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\en\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\es\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fil\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hu\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\id\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\it\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ja\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ko\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ru\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\nl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\no\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_br\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_pt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ro\1ywr2c1yk.readme.txt
%ALLUSERSPROFILE%\application data\1ywr2c1yk.bmp
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\se\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\th\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\tr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\uk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\cs\1ywr2c1yk.readme.txt
C:\documents and settings\default user\printhood\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ca\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sk\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ko\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_br\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\no\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\nl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ja\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\da\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\it\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\id\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hu\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\he\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_pt\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ro\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sl\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sv\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\th\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\tr\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\vi\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ar\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\bg\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_tw\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ru\1ywr2c1yk.readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_cn\1ywr2c1yk.readme.txt
%ALLUSERSPROFILE%\application data\2.tmp

Удаляет следующие файлы

<SYSTEM32>\config\appevent.evt
<SYSTEM32>\config\odiag.evt
<SYSTEM32>\config\osession.evt
<SYSTEM32>\config\secevent.evt

Перемещает следующие файлы

%TEMP%\adobearm.log в %TEMP%\adobearm.log.1ywr2c1yk
%TEMP%\dotnetfxsdk.log в %TEMP%\dotnetfxsdk.log.1ywr2c1yk
%TEMP%\jaureg.log в %TEMP%\jaureg.log.1ywr2c1yk
%TEMP%\javadeployreg.log в %TEMP%\javadeployreg.log.1ywr2c1yk
%TEMP%\java_install.log в %TEMP%\java_install.log.1ywr2c1yk
%TEMP%\java_install_reg.log в %TEMP%\java_install_reg.log.1ywr2c1yk
%TEMP%\jawshtml.html в %TEMP%\jawshtml.html.1ywr2c1yk
%TEMP%\jusched.log в %TEMP%\jusched.log.1ywr2c1yk
%TEMP%\dd_xps.txt в %TEMP%\dd_xps.txt.1ywr2c1yk
%TEMP%\dotnetfx.log в %TEMP%\dotnetfx.log.1ywr2c1yk
%TEMP%\microsoft .net framework 3.0-kb976570_20150831_175648373.html в %TEMP%\microsoft .net framework 3.0-kb976570_20150831_175648373.html.1ywr2c1yk
%TEMP%\microsoft .net framework 4.5 setup_20150820_123115526.html в %TEMP%\microsoft .net framework 4.5 setup_20150820_123115526.html.1ywr2c1yk
%TEMP%\microsoft .net framework 4.5 setup_20150831_105942303.html в %TEMP%\microsoft .net framework 4.5 setup_20150831_105942303.html.1ywr2c1yk
%TEMP%\microsoft .net framework 4.5.2 setup_20151215_221953317.html в %TEMP%\microsoft .net framework 4.5.2 setup_20151215_221953317.html.1ywr2c1yk
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150820_123340645.html в %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150820_123340645.html.1ywr2c1yk
%TEMP%\setupexe(201511201342324e4).log в %TEMP%\setupexe(201511201342324e4).log.1ywr2c1yk
%TEMP%\setupexe(20151215230521214).log в %TEMP%\setupexe(20151215230521214).log.1ywr2c1yk
%TEMP%\setupexe(2015121523093290).log в %TEMP%\setupexe(2015121523093290).log.1ywr2c1yk
%TEMP%\microsoft .net framework 4 setup_20150820_122814726.html в %TEMP%\microsoft .net framework 4 setup_20150820_122814726.html.1ywr2c1yk
%TEMP%\microsoft .net framework 4 setup_20150831_105924687.html в %TEMP%\microsoft .net framework 4 setup_20150831_105924687.html.1ywr2c1yk
%TEMP%\dd_wcf_retca4a2a.txt в %TEMP%\dd_wcf_retca4a2a.txt.1ywr2c1yk
%TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log.1ywr2c1yk
%TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log.1ywr2c1yk
%TEMP%\adobesfx.log в %TEMP%\adobesfx.log.1ywr2c1yk
%TEMP%\aspnetsetup.log в %TEMP%\aspnetsetup.log.1ywr2c1yk
%TEMP%\aspnetsetup_00000.log в %TEMP%\aspnetsetup_00000.log.1ywr2c1yk
%TEMP%\aucheck_parser.txt в %TEMP%\aucheck_parser.txt.1ywr2c1yk
%TEMP%\dd_clwireg.txt в %TEMP%\dd_clwireg.txt.1ywr2c1yk
%TEMP%\dd_depcheck_netfx20_exp_35.txt в %TEMP%\dd_depcheck_netfx20_exp_35.txt.1ywr2c1yk
%TEMP%\dd_depcheck_netfx_exp_35.txt в %TEMP%\dd_depcheck_netfx_exp_35.txt.1ywr2c1yk
%TEMP%\dd_dotnetfx20error.txt в %TEMP%\dd_dotnetfx20error.txt.1ywr2c1yk
%TEMP%\adobearm_notlocked.log в %TEMP%\adobearm_notlocked.log.1ywr2c1yk
%TEMP%\dd_dotnetfx20install.txt в %TEMP%\dd_dotnetfx20install.txt.1ywr2c1yk
%TEMP%\dd_dotnetfx35install.txt в %TEMP%\dd_dotnetfx35install.txt.1ywr2c1yk
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.1ywr2c1yk
%TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt в %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.1ywr2c1yk
%TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.1ywr2c1yk
%TEMP%\dd_net_framework20_setup74f9.txt в %TEMP%\dd_net_framework20_setup74f9.txt.1ywr2c1yk
%TEMP%\dd_net_framework30_setup7762.txt в %TEMP%\dd_net_framework30_setup7762.txt.1ywr2c1yk
%TEMP%\dd_net_framework35_msi77c4.txt в %TEMP%\dd_net_framework35_msi77c4.txt.1ywr2c1yk
%TEMP%\dd_vcredist_x86_20151215221751.log в %TEMP%\dd_vcredist_x86_20151215221751.log.1ywr2c1yk
%TEMP%\dd_dotnetfx35error.txt в %TEMP%\dd_dotnetfx35error.txt.1ywr2c1yk
%TEMP%\uxeventlog.txt в %TEMP%\uxeventlog.txt.1ywr2c1yk
%TEMP%\wubi-14.04-rev286.log в %TEMP%\wubi-14.04-rev286.log.1ywr2c1yk

Изменяет следующие файлы

C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\desktop.ini
%TEMP%\dd_dotnetfx35error.txt.1ywr2c1yk
%TEMP%\dd_dotnetfx20install.txt.1ywr2c1yk
%TEMP%\dd_depcheck_netfx_exp_35.txt.1ywr2c1yk
%TEMP%\dd_dotnetfx20error.txt.1ywr2c1yk
%TEMP%\dd_depcheck_netfx20_exp_35.txt.1ywr2c1yk
%TEMP%\dd_clwireg.txt.1ywr2c1yk
%TEMP%\aucheck_parser.txt.1ywr2c1yk
%TEMP%\aspnetsetup_00000.log.1ywr2c1yk
%TEMP%\aspnetsetup.log.1ywr2c1yk
%TEMP%\adobesfx.log.1ywr2c1yk
%TEMP%\adobearm_notlocked.log.1ywr2c1yk
%TEMP%\adobearm.log.1ywr2c1yk
%HOMEPATH%\templates\wordpfct.wpg.1ywr2c1yk
%HOMEPATH%\templates\wordpfct.wpd.1ywr2c1yk
%HOMEPATH%\templates\winword2.doc.1ywr2c1yk
%HOMEPATH%\templates\winword.doc.1ywr2c1yk
%HOMEPATH%\templates\sndrec.wav.1ywr2c1yk
%HOMEPATH%\templates\quattro.wb2.1ywr2c1yk
%HOMEPATH%\templates\presenta.shw.1ywr2c1yk
%HOMEPATH%\templates\powerpnt.ppt.1ywr2c1yk
%HOMEPATH%\templates\lotus.wk4.1ywr2c1yk
%HOMEPATH%\templates\excel4.xls.1ywr2c1yk
%HOMEPATH%\templates\excel.xls.1ywr2c1yk
%HOMEPATH%\templates\amipro.sam.1ywr2c1yk
%HOMEPATH%\and.1ywr2c1yk
C:\documents.1ywr2c1yk
C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\info2
%TEMP%\dd_dotnetfx35install.txt.1ywr2c1yk
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.1ywr2c1yk

Изменяет множество файлов.

Самоперемещается

из <Полный путь к файлу> в <Текущая директория>\aaaaaaaa
из <Текущая директория>\wwwwwwww в <Текущая директория>\xxxxxxxx
из <Текущая директория>\vvvvvvvv в <Текущая директория>\wwwwwwww
из <Текущая директория>\uuuuuuuu в <Текущая директория>\vvvvvvvv
из <Текущая директория>\tttttttt в <Текущая директория>\uuuuuuuu
из <Текущая директория>\ssssssss в <Текущая директория>\tttttttt
из <Текущая директория>\rrrrrrrr в <Текущая директория>\ssssssss
из <Текущая директория>\qqqqqqqq в <Текущая директория>\rrrrrrrr
из <Текущая директория>\pppppppp в <Текущая директория>\qqqqqqqq
из <Текущая директория>\oooooooo в <Текущая директория>\pppppppp
из <Текущая директория>\nnnnnnnn в <Текущая директория>\oooooooo
из <Текущая директория>\mmmmmmmm в <Текущая директория>\nnnnnnnn
из <Текущая директория>\llllllll в <Текущая директория>\mmmmmmmm
из <Текущая директория>\kkkkkkkk в <Текущая директория>\llllllll
из <Текущая директория>\jjjjjjjj в <Текущая директория>\kkkkkkkk
из <Текущая директория>\iiiiiiii в <Текущая директория>\jjjjjjjj
из <Текущая директория>\hhhhhhhh в <Текущая директория>\iiiiiiii
из <Текущая директория>\gggggggg в <Текущая директория>\hhhhhhhh
из <Текущая директория>\ffffffff в <Текущая директория>\gggggggg
из <Текущая директория>\eeeeeeee в <Текущая директория>\ffffffff
из <Текущая директория>\dddddddd в <Текущая директория>\eeeeeeee
из <Текущая директория>\cccccccc в <Текущая директория>\dddddddd
из <Текущая директория>\bbbbbbbb в <Текущая директория>\cccccccc
из <Текущая директория>\aaaaaaaa в <Текущая директория>\bbbbbbbb
из <Текущая директория>\xxxxxxxx в <Текущая директория>\yyyyyyyy
из <Текущая директория>\yyyyyyyy в <Текущая директория>\zzzzzzzz

Самоудаляется.

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Создает и запускает на исполнение

'%ALLUSERSPROFILE%\application data\2.tmp'

Запускает на исполнение

'<SYSTEM32>\verclsid.exe' /C {2559A1F4-21D7-11D4-BDAF-00C04F60B9F0} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
'<SYSTEM32>\verclsid.exe' /C {2559A1F5-21D7-11D4-BDAF-00C04F60B9F0} /I {000214E6-0000-0000-C000-000000000046} /X 0x401

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней