Trojan.Encoder.29105

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\p08q3-readme.txt
%HOMEPATH%\start menu\programs\startup\p08q3-readme.txt

Creates the following files on removable media

<Drive name for removable media>:\p08q3-readme.txt
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

C:\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\cs\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\da\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\de\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\el\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\en\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ru\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\es\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fil\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\he\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\hu\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ar\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\fi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ca\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\bg\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_tw\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\zh_cn\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nb\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\nl\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pl\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_br\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\pt_pt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\id\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ro\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ko\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sk\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sr\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sv\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\th\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\tr\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\uk\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lt\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\vi\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\sl\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\lv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\it\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\bg\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ca\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\cs\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\da\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\de\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\el\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_cn\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\en\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fil\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\fr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\hu\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ar\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\zh_tw\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\vi\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\tr\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\nl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\no\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_br\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\pt_pt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ja\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\lt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ko\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ro\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\th\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\tr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\uk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\ru\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\sl\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ja\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\it\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\id\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ml\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mo\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mr\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ms\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mt\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\my\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ro\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\nb\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\nl\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\nn\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\oc\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\pl\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\pt\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\lt\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ku\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mk\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ko\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\kn\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fr\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\gl\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\gu\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\he\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\hi\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\hr\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\hu\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ne\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\is\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ja\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\jv\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ka\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\kab\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\kk\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\id\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fy\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\it\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\lv\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ru\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\ca\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\da\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\de\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\el\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\en_gb\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\bg\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\shn\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\cs\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fil\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fr\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hi\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hr\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\hu\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\es_419\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\et\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\fi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\es\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\id\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sl\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sq\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sr\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sv\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ta\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\te\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\th\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ug\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\uk\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ur\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\uz\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\vi\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\wae\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sk\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\tw\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\no\p08q3-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\browser-region\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ko\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\th\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\tr\p08q3-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\p08q3-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\locale\p08q3-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\branding\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lt\p08q3-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\browser-region\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\pkt\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\util\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\common\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\win32\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\win32\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ar\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sl\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\msg\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\sk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ru\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hu\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\id\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\it\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ja\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\bg\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ko\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\lv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\nl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\no\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_br\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\pt_pt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\he\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ro\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ms\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\hi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ca\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\el\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_pt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ro\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ru\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\nl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\sv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\tr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\uk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\vi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_cn\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\zh_tw\p08q3-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\locale\branding\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\pt_br\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\no\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\it\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\en\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\es\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fil\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\fr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\cs\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\de\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\da\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\he\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\id\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\it\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ja\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\ko\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\lt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\hu\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fil\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\fi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\eu\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ca\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\cs\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\da\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\de\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\el\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\he\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_gb\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\es_419\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\et\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fil\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\_locales\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_tw\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\bg\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\zh_cn\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\vi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\nl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\no\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_br\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\pt_pt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\fr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ro\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\en_us\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\se\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\th\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\tr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\uk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ru\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\lv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\sk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ar\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\uk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_cn\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\zh_tw\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ar\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\bg\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\ca\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\tr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\vi\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\cs\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_gb\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\en_us\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\es_419\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\et\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\da\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\de\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\el\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fi\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\ja\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sr\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\id\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\it\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ja\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ko\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\lv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sv\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\th\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\nl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_br\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pt_pt\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ro\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\ru\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\sl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\hu\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\pl\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\_locales\th\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fa\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\el\lc_messages\p08q3-readme.txt
%TEMP%\hsperfdata_user\p08q3-readme.txt
%TEMP%\lilo.1120\p08q3-readme.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\p08q3-readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\p08q3-readme.txt
%TEMP%\opera installer\p08q3-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\p08q3-readme.txt
%TEMP%\outlook logging\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\p08q3-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\p08q3-readme.txt
%TEMP%\adobe_admlogs\p08q3-readme.txt
%TEMP%\pyl1.tmp\p08q3-readme.txt
%TEMP%\history\p08q3-readme.txt
%TEMP%\cookies\p08q3-readme.txt
%TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\p08q3-readme.txt
%TEMP%\2.9.0.1467 (partner)\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\mirc\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\qip 2012\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\steam\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\winrar\p08q3-readme.txt
C:\documents and settings\default user\local settings\history\history.ie5\p08q3-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\p08q3-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\google chrome\p08q3-readme.txt
C:\documents and settings\default user\start menu\programs\startup\p08q3-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\history\history.ie5\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\p08q3-readme.txt
%HOMEPATH%\favorites\links\почта.url
%HOMEPATH%\favorites\links\яндекс.url
%ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\p08q3-readme.txt
%HOMEPATH%\local settings\history\history.ie5\p08q3-readme.txt
C:\documents and settings\localservice\local settings\history\history.ie5\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\p08q3-readme.txt
%TEMP%\<INETFILES>\p08q3-readme.txt
%TEMP%\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\p08q3-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\p08q3-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\p08q3-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\p08q3-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\z9pmdpek\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\p08q3-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\p08q3-readme.txt
%TEMP%\history\history.ie5\p08q3-readme.txt
%TEMP%\pyl1.tmp\bin\p08q3-readme.txt
%TEMP%\pyl1.tmp\data\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\p08q3-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\entertainment\p08q3-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\p08q3-readme.txt
C:\documents and settings\default user\start menu\programs\accessories\accessibility\p08q3-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\h8mbgrq8\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my videos\p08q3-readme.txt
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\p08q3-readme.txt
%HOMEPATH%\start menu\programs\accessories\p08q3-readme.txt
%HOMEPATH%\start menu\programs\administrative tools\p08q3-readme.txt
%HOMEPATH%\start menu\programs\icq\p08q3-readme.txt
%HOMEPATH%\start menu\programs\telegram desktop\p08q3-readme.txt
%TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\p08q3-readme.txt
%TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\p08q3-readme.txt
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\p08q3-readme.txt
%HOMEPATH%\start menu\programs\winrar\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\system tools\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\p08q3-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ee7gwdg8\p08q3-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\etuaii8e\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\communications\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\games\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\administrative tools\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\p08q3-readme.txt
C:\documents and settings\default user\printhood\p08q3-readme.txt
C:\documents and settings\default user\recent\p08q3-readme.txt
C:\documents and settings\default user\sendto\p08q3-readme.txt
C:\documents and settings\default user\start menu\p08q3-readme.txt
C:\documents and settings\default user\templates\p08q3-readme.txt
C:\documents and settings\localservice\cookies\p08q3-readme.txt
%HOMEPATH%\my documents\p08q3-readme.txt
C:\documents and settings\localservice\local settings\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\p08q3-readme.txt
%HOMEPATH%\.oracle_jre_usage\p08q3-readme.txt
%HOMEPATH%\cookies\p08q3-readme.txt
%HOMEPATH%\desktop\p08q3-readme.txt
%HOMEPATH%\favorites\p08q3-readme.txt
C:\documents and settings\default user\local settings\p08q3-readme.txt
C:\documents and settings\default user\favorites\p08q3-readme.txt
C:\documents and settings\default user\nethood\p08q3-readme.txt
C:\documents and settings\default user\desktop\p08q3-readme.txt
C:\documents and settings\default user\cookies\p08q3-readme.txt
C:\documents and settings\p08q3-readme.txt
%ProgramFiles%\p08q3-readme.txt
C:\recycler\p08q3-readme.txt
%ALLUSERSPROFILE%\p08q3-readme.txt
C:\documents and settings\default user\p08q3-readme.txt
C:\documents and settings\localservice\p08q3-readme.txt
%HOMEPATH%\local settings\p08q3-readme.txt
C:\documents and settings\networkservice\p08q3-readme.txt
C:\documents and settings\networkservice\cookies\p08q3-readme.txt
C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\p08q3-readme.txt
%ALLUSERSPROFILE%\drm\p08q3-readme.txt
%ALLUSERSPROFILE%\favorites\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\p08q3-readme.txt
%ALLUSERSPROFILE%\templates\p08q3-readme.txt
%HOMEPATH%\p08q3-readme.txt
<Current directory>\p08q3-readme.txt
%ALLUSERSPROFILE%\desktop\p08q3-readme.txt
C:\documents and settings\default user\my documents\p08q3-readme.txt
%HOMEPATH%\nethood\p08q3-readme.txt
%HOMEPATH%\favorites\links\p08q3-readme.txt
%TEMP%\p08q3-readme.txt
%HOMEPATH%\local settings\<INETFILES>\p08q3-readme.txt
%HOMEPATH%\my documents\downloads\p08q3-readme.txt
%HOMEPATH%\my documents\my music\p08q3-readme.txt
%HOMEPATH%\my documents\my pictures\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\p08q3-readme.txt
%HOMEPATH%\printhood\p08q3-readme.txt
%HOMEPATH%\local settings\history\p08q3-readme.txt
%HOMEPATH%\start menu\programs\p08q3-readme.txt
%HOMEPATH%\userdata\ubghkdcj\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my music\my playlists\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample music\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\p08q3-readme.txt
%HOMEPATH%\userdata\09upir0l\p08q3-readme.txt
%HOMEPATH%\userdata\e3unqlkn\p08q3-readme.txt
%HOMEPATH%\userdata\inafedwn\p08q3-readme.txt
%HOMEPATH%\local settings\history\history.ie5\mshist012017042620170427\p08q3-readme.txt
%TEMP%\pyl1.tmp\winboot\p08q3-readme.txt
C:\documents and settings\localservice\local settings\<INETFILES>\p08q3-readme.txt
%HOMEPATH%\sendto\p08q3-readme.txt
%HOMEPATH%\start menu\p08q3-readme.txt
%HOMEPATH%\templates\p08q3-readme.txt
%HOMEPATH%\userdata\p08q3-readme.txt
%HOMEPATH%\voip\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my music\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\history\p08q3-readme.txt
C:\documents and settings\networkservice\local settings\temp\p08q3-readme.txt
%ALLUSERSPROFILE%\documents\my pictures\p08q3-readme.txt
C:\documents and settings\default user\local settings\history\p08q3-readme.txt
C:\documents and settings\default user\local settings\temp\p08q3-readme.txt
C:\documents and settings\default user\local settings\<INETFILES>\p08q3-readme.txt
C:\documents and settings\default user\start menu\programs\p08q3-readme.txt
C:\documents and settings\localservice\local settings\history\p08q3-readme.txt
C:\documents and settings\localservice\local settings\temp\p08q3-readme.txt
%HOMEPATH%\recent\p08q3-readme.txt
%ALLUSERSPROFILE%\start menu\programs\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fi\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\et\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\vi\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\wae\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\zh_cn\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\zh_hk\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\zh_tw\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sk\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\_locales\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\__macosx\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\_locales\p08q3-readme.txt
%TEMP%\scoped_dir_2812_24406\crx_install\__macosx\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\_locales\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\_locales\p08q3-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\en-gb\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\uk\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\_locales\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\uz\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ur\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ug\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\tw\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\pl\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\pt\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\pt_br\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ro\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ru\p08q3-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\en-gb\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\shn\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\nl\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sl\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sr\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sv\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ta\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\te\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\th\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\nn\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\tr\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\sq\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\oc\p08q3-readme.txt
%TEMP%\<INETFILES>\content.ie5\4xoboj8j\p08q3-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\locale\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ca\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\crh\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\cs\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\csb\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\cy\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\da\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\bg\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\de\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en_au\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\eo\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\es\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\br\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\bs\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\bo\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ast\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2064_18724\crx_install\p08q3-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\hooks\p08q3-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\packages\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\cipher\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\hash\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\publickey\p08q3-readme.txt
%TEMP%\<INETFILES>\content.ie5\chyzclen\p08q3-readme.txt
%TEMP%\<INETFILES>\content.ie5\ibwpozo7\p08q3-readme.txt
%TEMP%\<INETFILES>\content.ie5\g1qjk5mv\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\util\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\xml\parsers\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\xml\sax\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\af\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ar\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\as\lc_messages\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\sap\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\backends\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\frontends\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ne\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\nb\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\my\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\af\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ar\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\as\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ast\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\bg\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\bo\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\de\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\br\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ca\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\crh\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\cs\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\csb\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\cy\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\winui\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\urlgrabber\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\xml\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\sets\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\openpgp\p08q3-readme.txt
%TEMP%\scoped_dir_2812_28580\crx_install\p08q3-readme.txt
%TEMP%\temporary directory 1 for omni.ja_20150820125829.zip\chrome\p08q3-readme.txt
%TEMP%\temporary directory 2 for omni.ja_20150820125829.zip\chrome\p08q3-readme.txt
%TEMP%\<INETFILES>\content.ie5\p08q3-readme.txt
%HOMEPATH%\start menu\programs\accessories\accessibility\p08q3-readme.txt
%HOMEPATH%\start menu\programs\accessories\entertainment\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\da\p08q3-readme.txt
%TEMP%\2.9.0.1467 (partner)\chrome\en-gb\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\bs\p08q3-readme.txt
%TEMP%\pyl1.tmp\data\custom-installation\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\bittorrent\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\crypto\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\ctypes\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\encodings\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\logging\p08q3-readme.txt
%TEMP%\pyl1.tmp\bin\formats\p08q3-readme.txt
%TEMP%\scoped_dir_2812_9112\crx_install\p08q3-readme.txt
%TEMP%\pyl1.tmp\data\images\p08q3-readme.txt
%TEMP%\pyl1.tmp\lib\wubi\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\el\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ja\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ka\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\kab\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\kk\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\kn\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ko\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\it\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\jv\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ku\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ml\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mo\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mr\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\ms\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mt\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\lt\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\lv\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\mk\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\eu\lc_messages\p08q3-readme.txt
%TEMP%\scoped_dir_2812_13253\crx_install\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\hu\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en_ca\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en_gb\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\eo\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\es\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\et\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\eu\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\id\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\is\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fa\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fy\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\gl\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\gu\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\he\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\hi\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\hr\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\en_au\p08q3-readme.txt
%TEMP%\pyl1.tmp\translations\fr\p08q3-readme.txt
D:\p08q3-readme.txt

Moves the following files

from %HOMEPATH%\favorites\links\почта.url to %HOMEPATH%\favorites\links\почта.url.p08q3
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.p08q3
from %TEMP%\dd_vcredist_x86_20151215221751.log to %TEMP%\dd_vcredist_x86_20151215221751.log.p08q3
from %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log.p08q3
from %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log.p08q3
from %TEMP%\dd_xps.txt to %TEMP%\dd_xps.txt.p08q3
from %TEMP%\java_install.log to %TEMP%\java_install.log.p08q3
from %TEMP%\dd_depcheck_netfx20_exp_35.txt to %TEMP%\dd_depcheck_netfx20_exp_35.txt.p08q3
from %TEMP%\java_install_reg.log to %TEMP%\java_install_reg.log.p08q3
from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\dd_net_framework30_setup7762.txt.p08q3
from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\dd_net_framework35_msi77c4.txt.p08q3
from %TEMP%\setupexe(201511201342324e4).log to %TEMP%\setupexe(201511201342324e4).log.p08q3
from %TEMP%\setupexe(20151215230521214).log to %TEMP%\setupexe(20151215230521214).log.p08q3
from %TEMP%\setupexe(2015121523093290).log to %TEMP%\setupexe(2015121523093290).log.p08q3
from %TEMP%\uxeventlog.txt to %TEMP%\uxeventlog.txt.p08q3
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.p08q3
from %TEMP%\jaureg.log to %TEMP%\jaureg.log.p08q3
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.p08q3
from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd_wcf_retca4a2a.txt.p08q3
from %TEMP%\dd_dotnetfx35install.txt to %TEMP%\dd_dotnetfx35install.txt.p08q3
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.p08q3
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.p08q3
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.p08q3
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.p08q3
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.p08q3
from %TEMP%\aucheck_parser.txt to %TEMP%\aucheck_parser.txt.p08q3
from %TEMP%\wubi-14.04-rev286.log to %TEMP%\wubi-14.04-rev286.log.p08q3
from %TEMP%\jusched.log to %TEMP%\jusched.log.p08q3
from %TEMP%\dd_clwireg.txt to %TEMP%\dd_clwireg.txt.p08q3
from %TEMP%\dd_dotnetfx35error.txt to %TEMP%\dd_dotnetfx35error.txt.p08q3
from %TEMP%\dd_dotnetfx20install.txt to %TEMP%\dd_dotnetfx20install.txt.p08q3
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.p08q3
from %TEMP%\dd_depcheck_netfx_exp_35.txt to %TEMP%\dd_depcheck_netfx_exp_35.txt.p08q3
from %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt to %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.p08q3
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.p08q3
from %HOMEPATH%\favorites\links\яндекс.url to %HOMEPATH%\favorites\links\яндекс.url.p08q3
from %TEMP%\dd_dotnetfx20error.txt to %TEMP%\dd_dotnetfx20error.txt.p08q3
from %TEMP%\dd_net_framework20_setup74f9.txt to %TEMP%\dd_net_framework20_setup74f9.txt.p08q3

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)

Executes the following

'<SYSTEM32>\verclsid.exe' /C {B5A7F190-DDA6-4420-B3BA-52453494E6CD} /I {00000000-0000-0000-C000-000000000046} /X 0x401
'<SYSTEM32>\verclsid.exe' /C {6C467336-8281-4E60-8204-430CED96822D} /I {000214E8-0000-0000-C000-000000000046} /X 0x401
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial