Trojan.DownLoader35.536

Technical Information

Modifies file system

Creates the following files

%TEMP%\_mei9282\vcruntime140.dll
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\textview.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\textbox.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\textarea.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\statictext.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\sectionheading.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\radio.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\password.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\numeric.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\listbox.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\line.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\image.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\heading.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\embeddedview.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\network sharing\wmpnss_color120.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\digitalink.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\date.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\currency.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\contact.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\combobox.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\checkbox.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\button.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\break.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\attachments.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\viewheaderpreview.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formtoolimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsviewattachmenticons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\addtoviewarrow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\markupiconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\datetime.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\inactivetabimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\bodypanebackground.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formtoolimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\addtoviewarrow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\network sharing\wmpnss_bw48.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\network sharing\wmpnss_bw32.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\network sharing\wmpnss_bw120.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\media renderer\dmr_48.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\media renderer\dmr_120.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\stationery\1033\seamarbl.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\stationery\1033\pinelumb.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\stationery\1033\notebook.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\zoomicons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\whitebox.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\tabon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsviewattachmenticons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\taboff.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\unformattednumeric.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttaskicon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projectstatusicons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\meetingicon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\circleicons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\briefcaseicon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\infopathwelcomeimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\formsviewattachmenticons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\viewheaderpreview.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formtoolimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsviewattachmenticons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\addtoviewarrow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\viewheaderpreview.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\splashimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03143i.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttoolseticonimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contacthigh.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\outlinetooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifieruparrow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdownarrow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdisableuparrow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdisabledownarrow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierclosebutton.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackgroundrtl.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackground.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24images.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\logindialogbackground.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\informationicon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\discussiontooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\grip.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\discussiontooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\datalisticonimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\media\cagcat10\j0315447.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\media\cagcat10\j0302953.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\media\cagcat10\j0302827.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\media\cagcat10\j0284916.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03425i.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03380i.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03379i.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03224i.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\activetabimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\wssfilestoolhomepagebackground.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\shared16x16images.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\picturestooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\computericon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadiconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadicon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\messageboxiconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimagesmall.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimagesmall.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_off.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_medium.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_high.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_fileoff.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\questionicon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_filehigh.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\outofsynciconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_auto.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\globebuttonimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendarviewbuttonimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendartooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\wssfilestooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\webtoolimages16x16.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\webtooliconimages.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\verisignlogo.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\tipsimage.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\stopicon.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\spacebackupicons.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\toolbmps\shared24x24images.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contactlow.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03205i.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\network sharing\wmpnss_color32.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\stars.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\peacock.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\orangecircles.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\notebook.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\monet.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\handprints.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\greenbubbles.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\garden.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\blue_gradient.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\bears.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\tulips.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\penguins.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\lighthouse.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\koala.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\sunrise.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\jellyfish.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\desert.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\chrysanthemum.jpg[fake.raks.44100@gmail.com].enc
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\welcomescan.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\windows sidebar\gadgets\slideshow.gadget\images\tulip.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\windows media player\media renderer\dmr_48.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\windows media player\media renderer\dmr_120.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\skins\winamp modern\notifier\sc_alb_art.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\skins\winamp modern\notifier\aol_radio_alb_art.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\skins\big bento\window\sc_alb_art.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\skins\big bento\window\aol_radio_alb_art.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\skins\big bento\about\about_fg.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\skins\bento\window\sc_alb_art.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\skins\bento\window\aol_radio_alb_art.jpg[fake.raks.44100@gmail.com].enc
C:\users\public\pictures\sample pictures\hydrangeas.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\wrenches.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\pine_lumber.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\pt\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\uz\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\ua\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\tr\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\ru\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\pt\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\kz\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\en\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\de\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\cz\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\mail.ru\agent\mra\html\bg\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\uz\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\ua\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\tr\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\psychedelic.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\pretty_peacock.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\kz\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\en\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\de\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\cz\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\bg\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\white_chocolate.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\tanspecks.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\stars.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\softblue.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\small_news.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\shadesofblue.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\sand_paper.jpg[fake.raks.44100@gmail.com].enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\roses.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\icqm\icq\html\ru\error\exclamation.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\images\default_thumb.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows media player\network sharing\wmpnss_color48.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\smalltiled_electric_nebula.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\graphics\broadcast\desktop_placeholder.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album9.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album8.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album7.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album6.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album5.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album4.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album3.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album2.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album1.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\generic.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\cog_transparent.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\bootstrapper.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\settings\controller_diagnostic_1.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\store\holidaysalebg.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\smalltiled_ensign_meat.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\shadesofblue.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\roses.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\peacock.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\orangecircles.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\handprints.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\greenbubbles.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\garden.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\bears.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\tulip.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles(x86)%\microsoft shared\stationery\softblue.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\smalltiled_lizard_scales.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_01.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\clouds.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\clouds2.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\sky.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\seaweed.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\ruin.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\prayerwheel.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\paper.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\onefish.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\manyfish.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\lichen.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\kaite.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\image415.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\heart.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\facade01.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\smalltiled_colors3.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_01_over.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_02.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_shortcuts.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_overview.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_moystick.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_mouseregions.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_hometheater.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_gyro_touchmenu.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_gyro_ex_gamermuscle.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_gyro_ex_constablebento.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_06.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_05.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_04.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_03.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\cells.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph03041i.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02897j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02829j.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\white_chocolate.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\tanspecks.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\stars.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\softblue.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\small_news.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\shadesofblue.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\sand_paper.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\roses.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\psychedelic.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\pretty_peacock.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\pine_lumber.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\peacock.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099147.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\orangecircles.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\monet.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\handprints.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\greenbubbles.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\garden.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\blue_gradient.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\stationery\bears.jpg[fake.raks.44100@gmail.com].enc
%CommonProgramFiles%\microsoft shared\grphflt\ms.jpg[fake.raks.44100@gmail.com].enc
<Current directory>\path.txt
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\top_level.txt
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\wheel
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\record
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\metadata
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\license.psf
%CommonProgramFiles%\microsoft shared\stationery\notebook.jpg[fake.raks.44100@gmail.com].enc
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\license.bsd
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145895.jpg[fake.raks.44100@gmail.com].enc
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\license.apache
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145879.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145810.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145707.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145669.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145373.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145361.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145272.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145212.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145168.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0144773.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099191.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099190.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099189.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099150.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099148.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099186.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099185.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099168.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099167.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099166.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099165.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099162.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099161.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099160.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099157.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099156.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099155.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099154.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099187.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099152.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099188.jpg[fake.raks.44100@gmail.com].enc
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\installer
%TEMP%\_mei9282\cryptography\hazmat\bindings\_openssl.pyd
%TEMP%\_mei9282\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei9282\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei9282\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei9282\_ssl.pyd
%TEMP%\_mei9282\_socket.pyd
%TEMP%\_mei9282\_queue.pyd
%TEMP%\_mei9282\_lzma.pyd
%TEMP%\_mei9282\_hashlib.pyd
%TEMP%\_mei9282\_decimal.pyd
%TEMP%\_mei9282\_cffi_backend.cp37-win32.pyd
%TEMP%\_mei9282\_bz2.pyd
%TEMP%\_mei9282\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\license
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145904.jpg[fake.raks.44100@gmail.com].enc
%TEMP%\_mei9282\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei9282\cryptography-3.1.1-py3.7.egg-info\authors.rst
%TEMP%\_mei9282\certifi\cacert.pem
%TEMP%\_mei9282\base_library.zip
%TEMP%\_mei9282\unicodedata.pyd
%TEMP%\_mei9282\ucrtbase.dll
%TEMP%\_mei9282\slimodan_ransomware.exe.manifest
%TEMP%\_mei9282\select.pyd
%TEMP%\_mei9282\python37.dll
%TEMP%\_mei9282\python3.dll
%TEMP%\_mei9282\pyexpat.pyd
%TEMP%\_mei9282\libssl-1_1.dll
%TEMP%\_mei9282\libcrypto-1_1.dll
%TEMP%\_mei9282\cryptography\hazmat\bindings\_padding.pyd
%TEMP%\_mei9282\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei9282\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei9282\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099145.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0146142.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382952.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382967.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382966.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382963.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382961.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382959.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382955.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382954.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341653.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382969.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341738.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382947.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382944.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382942.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382938.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382926.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382836.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341742.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382950.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382970.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0387895.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0390072.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02759j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02567j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02412k.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02069j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02053j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02028k.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01931j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01239k.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01221k.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01213k.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01179j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\ph02810j.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0384885.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0387604.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0387591.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0387578.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0387337.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0386764.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0386485.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0386270.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0386267.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0386120.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0384900.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0384895.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0384888.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0387882.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341654.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341645.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0148309.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0287643.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0287642.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0287641.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0227558.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0227419.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0216153.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0216112.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0202045.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0182689.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0179963.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178932.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178639.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0287645.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178632.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178460.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178459.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178348.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0177806.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0177257.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0175428.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0175361.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0174952.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0164153.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0149118.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0149018.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0148798.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0148757.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178523.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0289430.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0287644.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0309480.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341636.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341344.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341634.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341561.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341559.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341557.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341554.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341551.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341534.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341499.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341475.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341455.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341448.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341447.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341439.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0341328.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0309567.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0337280.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0321179.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0315612.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0315580.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0314068.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0313974.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0313970.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0313965.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0313896.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0309705.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0309664.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0309598.jpg[fake.raks.44100@gmail.com].enc
%ProgramFiles%\microsoft office\clipart\pub60cor\j0309585.jpg[fake.raks.44100@gmail.com].enc
%APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg[fake.raks.44100@gmail.com].enc
%WINDIR%\globalization\mct\mct-au\wallpaper\au-wp1.jpg[fake.raks.44100@gmail.com].enc

Deletes the following files

%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\aspdotnet_logo.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\darkblue_grad.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\help.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\security_watermark.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\topgradrepeat.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\help.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg

Network activity

TCP

'ht##bin.org':443
'sm##.gmail.com':587
'ap#.##legram.org':443

UDP

DNS ASK ht##bin.org
DNS ASK sm##.gmail.com
DNS ASK ap#.##legram.org

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c "net share"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "cd / && dir /S /B *.jpg"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "cd / && dir /S /B *.jpeg"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "cd / && dir /S /B *.PNG"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "cd D: && dir /S /B *.jpg"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "cd D: && dir /S /B *.jpeg"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "cd D: && dir /S /B *.PNG"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c "net share"
'%WINDIR%\syswow64\net.exe' share
'%WINDIR%\syswow64\net1.exe' share
'%WINDIR%\syswow64\cmd.exe' /c "cd / && dir /S /B *.jpg"
'%WINDIR%\syswow64\cmd.exe' /c "cd / && dir /S /B *.jpeg"
'%WINDIR%\syswow64\cmd.exe' /c "cd / && dir /S /B *.PNG"
'%WINDIR%\syswow64\cmd.exe' /c "cd D: && dir /S /B *.jpg"
'%WINDIR%\syswow64\cmd.exe' /c "cd D: && dir /S /B *.jpeg"
'%WINDIR%\syswow64\cmd.exe' /c "cd D: && dir /S /B *.PNG"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial