Ransom_CRYPJAFF.A

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

マルウェアは、実行後、自身を削除します。

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のフォルダを作成します。

• %User Profile%\Application Data\Rondo

(註：%User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.)

作成活動

マルウェアは、以下のファイルを作成します。

• %Windows%\ReadMe.bmp
• %Windows%\ReadMe.html
• %Windows%\ReadMe.txt
• %User Profile%\ReadMe.bmp
• %User Profile%\ReadMe.html
• %User Profile%\ReadMe.txt
• %Program Files%\Messenger\ReadMe.bmp
• %Program Files%\Messenger\ReadMe.html
• %Program Files%\Messenger\ReadMe.txt
• %Program Files%\NetMeeting\ReadMe.bmp
• %Program Files%\NetMeeting\ReadMe.html
• %Program Files%\NetMeeting\ReadMe.txt
• %Program Files%\Outlook Express\ReadMe.bmp
• %Program Files%\Outlook Express\ReadMe.html
• %Program Files%\Outlook Express\ReadMe.txt
• %Program Files%\Windows Media Player\ReadMe.bmp
• %Program Files%\Windows Media Player\ReadMe.html
• %Program Files%\Windows Media Player\ReadMe.txt
• %Program Files%\WinPcap\ReadMe.bmp
• %Program Files%\WinPcap\ReadMe.html
• %Program Files%\WinPcap\ReadMe.txt
• %Windows%\Debug\ReadMe.bmp
• %Windows%\Debug\ReadMe.html
• %Windows%\Debug\ReadMe.txt
• %Windows%\Help\ReadMe.bmp
• %Windows%\Help\ReadMe.html
• %Windows%\Help\ReadMe.txt
• %Windows%\Media\ReadMe.bmp
• %Windows%\Media\ReadMe.html
• %Windows%\Media\ReadMe.txt
• %Windows%\pss\ReadMe.bmp
• %Windows%\pss\ReadMe.html
• %Windows%\pss\ReadMe.txt
• %Windows%\repair\ReadMe.bmp
• %Windows%\repair\ReadMe.html
• %Windows%\repair\ReadMe.txt
• %Windows%\SoftwareDistribution\ReadMe.bmp
• %Windows%\SoftwareDistribution\ReadMe.html
• %Windows%\SoftwareDistribution\ReadMe.txt
• %System%\ReadMe.bmp
• %System%\ReadMe.html
• %System%\ReadMe.txt
• %Temp%\ReadMe.bmp
• %Temp%\ReadMe.html
• %Temp%\ReadMe.txt
• %Windows%\Web\ReadMe.bmp
• %Windows%\Web\ReadMe.html
• %Windows%\Web\ReadMe.txt
• %User Profile%\SendTo\ReadMe.bmp
• %User Profile%\SendTo\ReadMe.html
• %User Profile%\SendTo\ReadMe.txt
• %User Profile%\Templates\ReadMe.bmp
• %User Profile%\Templates\ReadMe.html
• %User Profile%\Templates\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\ReadMe.txt
• %Program Files%\Common Files\Services\ReadMe.bmp
• %Program Files%\Common Files\Services\ReadMe.html
• %Program Files%\Common Files\Services\ReadMe.txt
• %Program Files%\Microsoft.NET\RedistList\ReadMe.bmp
• %Program Files%\Microsoft.NET\RedistList\ReadMe.html
• %Program Files%\Microsoft.NET\RedistList\ReadMe.txt
• %Program Files%\Movie Maker\Shared\ReadMe.bmp
• %Program Files%\Movie Maker\Shared\ReadMe.html
• %Program Files%\Movie Maker\Shared\ReadMe.txt
• %Program Files%\MSXML 6.0\EULA\ReadMe.bmp
• %Program Files%\MSXML 6.0\EULA\ReadMe.html
• %Program Files%\MSXML 6.0\EULA\ReadMe.txt
• %Program Files%\Windows NT\Pinball\ReadMe.bmp
• %Program Files%\Windows NT\Pinball\ReadMe.html
• %Program Files%\Windows NT\Pinball\ReadMe.txt
• %Windows%\$MSI31Uninstall_KB893803v2$\spuninst\ReadMe.bmp
• %Windows%\$MSI31Uninstall_KB893803v2$\spuninst\ReadMe.html
• %Windows%\$MSI31Uninstall_KB893803v2$\spuninst\ReadMe.txt
• %Windows%\$NtUninstallWIC$\spuninst\ReadMe.bmp
• %Windows%\$NtUninstallWIC$\spuninst\ReadMe.html
• %Windows%\$NtUninstallWIC$\spuninst\ReadMe.txt
• %Windows%\Debug\UserMode\ReadMe.bmp
• %Windows%\Debug\UserMode\ReadMe.html
• %Windows%\Debug\UserMode\ReadMe.txt
• %Windows%\security\logs\ReadMe.bmp
• %Windows%\security\logs\ReadMe.html
• %Windows%\security\logs\ReadMe.txt
• %Windows%\SoftwareDistribution\DataStore\ReadMe.bmp
• %Windows%\SoftwareDistribution\DataStore\ReadMe.html
• %Windows%\SoftwareDistribution\DataStore\ReadMe.txt
• %System%\CatRoot2\ReadMe.bmp
• %System%\CatRoot2\ReadMe.html
• %System%\CatRoot2\ReadMe.txt
• %System%\Com\ReadMe.bmp
• %System%\Com\ReadMe.html
• %System%\Com\ReadMe.txt
• %System%\config\ReadMe.bmp
• %System%\config\ReadMe.html
• %System%\config\ReadMe.txt
• %System%\drivers\ReadMe.bmp
• %System%\drivers\ReadMe.html
• %System%\drivers\ReadMe.txt
• %System%\ias\ReadMe.bmp
• %System%\ias\ReadMe.html
• %System%\ias\ReadMe.txt
• %System%\icsxml\ReadMe.bmp
• %System%\icsxml\ReadMe.html
• %System%\icsxml\ReadMe.txt
• %System%\MsDtc\ReadMe.bmp
• %System%\MsDtc\ReadMe.html
• %System%\MsDtc\ReadMe.txt
• %System%\oobe\ReadMe.bmp
• %System%\oobe\ReadMe.html
• %System%\oobe\ReadMe.txt
• %System%\wbem\ReadMe.bmp
• %System%\wbem\ReadMe.html
• %System%\wbem\ReadMe.txt
• %System%\XPSViewer\ReadMe.bmp
• %System%\XPSViewer\ReadMe.html
• %System%\XPSViewer\ReadMe.txt
• %Windows%\Web\printers\ReadMe.bmp
• %Windows%\Web\printers\ReadMe.html
• %Windows%\Web\printers\ReadMe.txt
• %Windows%\Web\Wallpaper\ReadMe.bmp
• %Windows%\Web\Wallpaper\ReadMe.html
• %Windows%\Web\Wallpaper\ReadMe.txt
• %Application Data%\ReadMe.bmp
• %Application Data%\ReadMe.html
• %Application Data%\ReadMe.txt
• %User Temp%\ReadMe.bmp
• %User Temp%\ReadMe.html
• %User Temp%\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Resource\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Resource\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Resource\ReadMe.txt
• %Program Files%\Common Files\Microsoft Shared\Stationery\ReadMe.bmp
• %Program Files%\Common Files\Microsoft Shared\Stationery\ReadMe.html
• %Program Files%\Common Files\Microsoft Shared\Stationery\ReadMe.txt
• %Program Files%\Common Files\System\ado\ReadMe.bmp
• %Program Files%\Common Files\System\ado\ReadMe.html
• %Program Files%\Common Files\System\ado\ReadMe.txt
• %Program Files%\Movie Maker\Shared\Profiles\ReadMe.bmp
• %Program Files%\Movie Maker\Shared\Profiles\ReadMe.html
• %Program Files%\Movie Maker\Shared\Profiles\ReadMe.txt
• %Program Files%\MSN\MSNCoreFiles\Install\ReadMe.bmp
• %Program Files%\MSN\MSNCoreFiles\Install\ReadMe.html
• %Program Files%\MSN\MSNCoreFiles\Install\ReadMe.txt
• %Windows%\Help\Tours\htmlTour\ReadMe.bmp
• %Windows%\Help\Tours\htmlTour\ReadMe.html
• %Windows%\Help\Tours\htmlTour\ReadMe.txt
• %Windows%\Help\Tours\mmTour\ReadMe.bmp
• %Windows%\Help\Tours\mmTour\ReadMe.html
• %Windows%\Help\Tours\mmTour\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v1.0.3705\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v1.0.3705\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v1.0.3705\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v1.1.4322\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v1.1.4322\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v1.1.4322\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v3.5\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v3.5\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v3.5\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ReadMe.txt
• %Windows%\pchealth\helpctr\Config\ReadMe.bmp
• %Windows%\pchealth\helpctr\Config\ReadMe.html
• %Windows%\pchealth\helpctr\Config\ReadMe.txt
• %Windows%\pchealth\helpctr\Database\ReadMe.bmp
• %Windows%\pchealth\helpctr\Database\ReadMe.html
• %Windows%\pchealth\helpctr\Database\ReadMe.txt
• %Windows%\pchealth\helpctr\DataColl\ReadMe.bmp
• %Windows%\pchealth\helpctr\DataColl\ReadMe.html
• %Windows%\pchealth\helpctr\DataColl\ReadMe.txt
• %Windows%\pchealth\helpctr\Logs\ReadMe.bmp
• %Windows%\pchealth\helpctr\Logs\ReadMe.html
• %Windows%\pchealth\helpctr\Logs\ReadMe.txt
• %Windows%\pchealth\helpctr\OfflineCache\ReadMe.bmp
• %Windows%\pchealth\helpctr\OfflineCache\ReadMe.html
• %Windows%\pchealth\helpctr\OfflineCache\ReadMe.txt
• %Windows%\pchealth\helpctr\PackageStore\ReadMe.bmp
• %Windows%\pchealth\helpctr\PackageStore\ReadMe.html
• %Windows%\pchealth\helpctr\PackageStore\ReadMe.txt
• %Windows%\pchealth\helpctr\System\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\ReadMe.html
• %Windows%\pchealth\helpctr\System\ReadMe.txt
• %Windows%\pchealth\UploadLB\Config\ReadMe.bmp
• %Windows%\pchealth\UploadLB\Config\ReadMe.html
• %Windows%\pchealth\UploadLB\Config\ReadMe.txt
• %Windows%\SoftwareDistribution\DataStore\Logs\ReadMe.bmp
• %Windows%\SoftwareDistribution\DataStore\Logs\ReadMe.html
• %Windows%\SoftwareDistribution\DataStore\Logs\ReadMe.txt
• %Windows%\srchasst\mui\0409\ReadMe.bmp
• %Windows%\srchasst\mui\0409\ReadMe.html
• %Windows%\srchasst\mui\0409\ReadMe.txt
• %System%\DirectX\Dinput\ReadMe.bmp
• %System%\DirectX\Dinput\ReadMe.html
• %System%\DirectX\Dinput\ReadMe.txt
• %System%\MsDtc\Trace\ReadMe.bmp
• %System%\MsDtc\Trace\ReadMe.html
• %System%\MsDtc\Trace\ReadMe.txt
• %System%\oobe\actsetup\ReadMe.bmp
• %System%\oobe\actsetup\ReadMe.html
• %System%\oobe\actsetup\ReadMe.txt
• %System%\oobe\error\ReadMe.bmp
• %System%\oobe\error\ReadMe.html
• %System%\oobe\error\ReadMe.txt
• %System%\oobe\icserror\ReadMe.bmp
• %System%\oobe\icserror\ReadMe.html
• %System%\oobe\icserror\ReadMe.txt
• %System%\oobe\images\ReadMe.bmp
• %System%\oobe\images\ReadMe.html
• %System%\oobe\images\ReadMe.txt
• %System%\oobe\isperror\ReadMe.bmp
• %System%\oobe\isperror\ReadMe.html
• %System%\oobe\isperror\ReadMe.txt
• %System%\oobe\regerror\ReadMe.bmp
• %System%\oobe\regerror\ReadMe.html
• %System%\oobe\regerror\ReadMe.txt
• %System%\oobe\setup\ReadMe.bmp
• %System%\oobe\setup\ReadMe.html
• %System%\oobe\setup\ReadMe.txt
• %System%\wbem\Logs\ReadMe.bmp
• %System%\wbem\Logs\ReadMe.html
• %System%\wbem\Logs\ReadMe.txt
• %System%\wbem\Performance\ReadMe.bmp
• %System%\wbem\Performance\ReadMe.html
• %System%\wbem\Performance\ReadMe.txt
• %System%\wbem\Repository\ReadMe.bmp
• %System%\wbem\Repository\ReadMe.html
• %System%\wbem\Repository\ReadMe.txt
• %System%\wbem\xml\ReadMe.bmp
• %System%\wbem\xml\ReadMe.html
• %System%\wbem\xml\ReadMe.txt
• %Windows%\Web\printers\images\ReadMe.bmp
• %Windows%\Web\printers\images\ReadMe.html
• %Windows%\Web\printers\images\ReadMe.txt
• %User Profile%\Sample Music\ReadMe.bmp
• %User Profile%\Sample Music\ReadMe.html
• %User Profile%\Sample Music\ReadMe.txt
• %User Profile%\Sample Pictures\ReadMe.bmp
• %User Profile%\Sample Pictures\ReadMe.html
• %User Profile%\Sample Pictures\ReadMe.txt
• %Application Data%\Microsoft\ReadMe.bmp
• %Application Data%\Microsoft\ReadMe.html
• %Application Data%\Microsoft\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\Javascripts\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\Javascripts\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\Javascripts\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\Services\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\Services\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\Services\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\Tracker\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\Tracker\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\Tracker\ReadMe.txt
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\ReadMe.bmp
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\ReadMe.html
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Cnt\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Cnt\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Cnt\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Css\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Css\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Css\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Scr\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Scr\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Scr\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Video\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Video\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Video\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v2.0.50727\CONFIG\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v2.0.50727\CONFIG\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v2.0.50727\CONFIG\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v2.0.50727\RedistList\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v2.0.50727\RedistList\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v2.0.50727\RedistList\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Config\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Config\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Config\ReadMe.txt
• %Windows%\pchealth\helpctr\Config\Cache\ReadMe.bmp
• %Windows%\pchealth\helpctr\Config\Cache\ReadMe.html
• %Windows%\pchealth\helpctr\Config\Cache\ReadMe.txt
• %Windows%\pchealth\helpctr\System\blurbs\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\blurbs\ReadMe.html
• %Windows%\pchealth\helpctr\System\blurbs\ReadMe.txt
• %Windows%\pchealth\helpctr\System\CompatCtr\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\CompatCtr\ReadMe.html
• %Windows%\pchealth\helpctr\System\CompatCtr\ReadMe.txt
• %Windows%\pchealth\helpctr\System\css\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\css\ReadMe.html
• %Windows%\pchealth\helpctr\System\css\ReadMe.txt
• %Windows%\pchealth\helpctr\System\dialogs\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\dialogs\ReadMe.html
• %Windows%\pchealth\helpctr\System\dialogs\ReadMe.txt
• %Windows%\pchealth\helpctr\System\DVDUpgrd\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\DVDUpgrd\ReadMe.html
• %Windows%\pchealth\helpctr\System\DVDUpgrd\ReadMe.txt
• %Windows%\pchealth\helpctr\System\ErrMsg\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\ErrMsg\ReadMe.html
• %Windows%\pchealth\helpctr\System\ErrMsg\ReadMe.txt
• %Windows%\pchealth\helpctr\System\errors\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\errors\ReadMe.html
• %Windows%\pchealth\helpctr\System\errors\ReadMe.txt
• %Windows%\pchealth\helpctr\System\images\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\images\ReadMe.html
• %Windows%\pchealth\helpctr\System\images\ReadMe.txt
• %Windows%\pchealth\helpctr\System\NetDiag\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\NetDiag\ReadMe.html
• %Windows%\pchealth\helpctr\System\NetDiag\ReadMe.txt
• %Windows%\pchealth\helpctr\System\panels\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\panels\ReadMe.html
• %Windows%\pchealth\helpctr\System\panels\ReadMe.txt
• %Windows%\pchealth\helpctr\System\rc\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\rc\ReadMe.html
• %Windows%\pchealth\helpctr\System\rc\ReadMe.txt
• %Windows%\pchealth\helpctr\System\Remote Assistance\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\ReadMe.html
• %Windows%\pchealth\helpctr\System\Remote Assistance\ReadMe.txt
• %Windows%\pchealth\helpctr\System\scripts\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\scripts\ReadMe.html
• %Windows%\pchealth\helpctr\System\scripts\ReadMe.txt
• %Windows%\pchealth\helpctr\System\sysinfo\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\sysinfo\ReadMe.html
• %Windows%\pchealth\helpctr\System\sysinfo\ReadMe.txt
• %Windows%\pchealth\helpctr\System\UpdateCtr\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\UpdateCtr\ReadMe.html
• %Windows%\pchealth\helpctr\System\UpdateCtr\ReadMe.txt
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\ReadMe.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\ReadMe.html
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\ReadMe.txt
• %System%\config\systemprofile\SendTo\ReadMe.bmp
• %System%\config\systemprofile\SendTo\ReadMe.html
• %System%\config\systemprofile\SendTo\ReadMe.txt
• %System%\config\systemprofile\Templates\ReadMe.bmp
• %System%\config\systemprofile\Templates\ReadMe.html
• %System%\config\systemprofile\Templates\ReadMe.txt
• %System%\oobe\html\dslmain\ReadMe.bmp
• %System%\oobe\html\dslmain\ReadMe.html
• %System%\oobe\html\dslmain\ReadMe.txt
• %System%\oobe\html\iconnect\ReadMe.bmp
• %System%\oobe\html\iconnect\ReadMe.html
• %System%\oobe\html\iconnect\ReadMe.txt
• %System%\oobe\html\isptype\ReadMe.bmp
• %System%\oobe\html\isptype\ReadMe.html
• %System%\oobe\html\isptype\ReadMe.txt
• %System%\oobe\html\mouse\ReadMe.bmp
• %System%\oobe\html\mouse\ReadMe.html
• %System%\oobe\html\mouse\ReadMe.txt
• %System%\oobe\html\sconnect\ReadMe.bmp
• %System%\oobe\html\sconnect\ReadMe.html
• %System%\oobe\html\sconnect\ReadMe.txt
• %Application Data%\Microsoft\Internet Explorer\ReadMe.bmp
• %Application Data%\Microsoft\Internet Explorer\ReadMe.html
• %Application Data%\Microsoft\Internet Explorer\ReadMe.txt
• %Application Data%\Microsoft\Windows\ReadMe.bmp
• %Application Data%\Microsoft\Windows\ReadMe.html
• %Application Data%\Microsoft\Windows\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\IDTemplates\ENU\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\IDTemplates\ENU\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\IDTemplates\ENU\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\Legal\ENU\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\Legal\ENU\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\Legal\ENU\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\ReadMe.txt
• %Program Files%\Common Files\SpeechEngines\Microsoft\TTS\1033\ReadMe.bmp
• %Program Files%\Common Files\SpeechEngines\Microsoft\TTS\1033\ReadMe.html
• %Program Files%\Common Files\SpeechEngines\Microsoft\TTS\1033\ReadMe.txt
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ReadMe.bmp
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ReadMe.html
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ReadMe.txt
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ReadMe.bmp
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ReadMe.html
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\Wav\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\Wav\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\Wav\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\Btn\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\Btn\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\Btn\ReadMe.txt
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\WMarks\ReadMe.bmp
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\WMarks\ReadMe.html
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\WMarks\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\Logs\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\Logs\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\Logs\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v3.5\SQL\EN\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v3.5\SQL\EN\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v3.5\SQL\EN\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SQL\en\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SQL\en\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SQL\en\ReadMe.txt
• %Windows%\pchealth\helpctr\System\images\16x16\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\ReadMe.html
• %Windows%\pchealth\helpctr\System\images\16x16\ReadMe.txt
• %Windows%\pchealth\helpctr\System\images\24x24\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\images\24x24\ReadMe.html
• %Windows%\pchealth\helpctr\System\images\24x24\ReadMe.txt
• %Windows%\pchealth\helpctr\System\images\32x32\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\images\32x32\ReadMe.html
• %Windows%\pchealth\helpctr\System\images\32x32\ReadMe.txt
• %Windows%\pchealth\helpctr\System\images\48x48\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\ReadMe.html
• %Windows%\pchealth\helpctr\System\images\48x48\ReadMe.txt
• %Windows%\pchealth\helpctr\System\images\Centers\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\images\Centers\ReadMe.html
• %Windows%\pchealth\helpctr\System\images\Centers\ReadMe.txt
• %Windows%\pchealth\helpctr\System\images\Expando\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\images\Expando\ReadMe.html
• %Windows%\pchealth\helpctr\System\images\Expando\ReadMe.txt
• %Windows%\pchealth\helpctr\System\panels\subpanels\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\panels\subpanels\ReadMe.html
• %Windows%\pchealth\helpctr\System\panels\subpanels\ReadMe.txt
• %Windows%\pchealth\helpctr\System\Remote Assistance\Common\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Common\ReadMe.html
• %Windows%\pchealth\helpctr\System\Remote Assistance\Common\ReadMe.txt
• %Windows%\pchealth\helpctr\System\Remote Assistance\Css\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Css\ReadMe.html
• %Windows%\pchealth\helpctr\System\Remote Assistance\Css\ReadMe.txt
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\ReadMe.html
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\ReadMe.txt
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\ReadMe.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\ReadMe.html
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\ReadMe.txt
• %System%\oobe\html\mouse\images\ReadMe.bmp
• %System%\oobe\html\mouse\images\ReadMe.html
• %System%\oobe\html\mouse\images\ReadMe.txt
• %System%\spool\drivers\w32x86\3\ReadMe.bmp
• %System%\spool\drivers\w32x86\3\ReadMe.html
• %System%\spool\drivers\w32x86\3\ReadMe.txt
• %Application Data%\Microsoft\Windows Media\9.0\ReadMe.bmp
• %Application Data%\Microsoft\Windows Media\9.0\ReadMe.html
• %Application Data%\Microsoft\Windows Media\9.0\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\ICU\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\ICU\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\ICU\ReadMe.txt
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bin\1033\ReadMe.bmp
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bin\1033\ReadMe.html
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bin\1033\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended\ReadMe.txt
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\ReadMe.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\ReadMe.html
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\ReadMe.txt
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\ReadMe.html
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\ReadMe.txt
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ReadMe.html
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ReadMe.txt
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ReadMe.html
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ReadMe.txt
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\ReadMe.html
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\ReadMe.txt
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\ReadMe.bmp
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\ReadMe.html
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\ReadMe.txt
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ReadMe.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ReadMe.html
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ReadMe.txt
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\ReadMe.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\ReadMe.html
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Adobe\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Adobe\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Adobe\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Mac\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Mac\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Mac\ReadMe.txt
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\win\ReadMe.bmp
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\win\ReadMe.html
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\win\ReadMe.txt
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\ReadMe.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\ReadMe.html
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\ReadMe.txt
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ReadMe.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ReadMe.html
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ReadMe.txt
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\ReadMe.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\ReadMe.html
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\ReadMe.txt
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\ReadMe.bmp
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\ReadMe.html
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\ReadMe.txt
• %User Profile%\Rondo\backup.om
• %User Profile%\Rondo\WallpapeR.bmp

(註：%Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.. %Program Files%フォルダは、プログラムファイルのフォルダで、いずれのオペレーティングシステム(OS)でも通常、 "C:\Program Files"、64bitのOS上で32bitのアプリケーションを実行している場合、 "C:\Program Files (x86)" です。.. %System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.. %Temp%フォルダは、一時的にファイルが保存されるフォルダで、いずれのオペレーティングシステム(OS)でも通常、 "C:\Windows\Temp" です。.. %Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。.. %User Temp%フォルダは、ユーザの一時フォルダで、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。.)

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

• http://{BLOCKED}bnn43.org/a5

マルウェアは、実行後、自身を削除します。

このウイルス情報は、自動解析システムにより作成されました。