Trojan.Encoder.31549

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\readme_readme_readme.txt

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im mysqld.exe

Modifies file system

Creates the following files

C:\readme_readme_readme.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aa7zvad[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aa4umnw[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aa42uqj[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\2_1__583[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\wmp_16x16[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\tothetop[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\top100[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\target[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\globalnav[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\satellitelib-46e65db5bb0c375f8f64619be31cc9b29acf4867[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\new-feature-13[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\menu-icon-8[1].svg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\menu-icon-2[1].svg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\menu-icon-1[1].svg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\logo-15x15[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\icon-pay-webmoney[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\icon-pay-mastercard[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\icon-pay-bank[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\new-feature-3[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\html5shiv-printshiv[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aafegoy[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbud9zo[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxbel[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxyym[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxobx[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuwmgm[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bburjeg[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbur7bl[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuq7ch[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuj3tl[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aafwcrx[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aafobng[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbub6o1[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbqu7t5[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbqmmou[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbluexm[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbllu8r[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bb7zbgb[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bb6mm6q[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aah7ldq[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbugxxc[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\fold-orange[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\fbevents[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\enable_all_features[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuo1vz[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuo1ii[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbukakc[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbufy9v[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbrgdep[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbqu5rt[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbigttt[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuqvk2[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bb1kvzy[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aagtlsq[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aag9xjb[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aacke3i[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aa9t45t[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aa7rdsl[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aa3l4oz[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aa1uh08[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\796x230brands2020[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aahc9vw[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bburmkm[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuqv6j[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuszol[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\compiled[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuyfjs[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\close[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\chartbeat[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\advert[1].gif1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\lvx-xkvaj0b[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbur0mo[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbummg1[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuz3fx[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuyylk[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuycab[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbutdqa[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxlsq[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxjre[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxevs[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxpzb[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwszi[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwknv[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwe5h[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwfyv[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxjup[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyhay[1].jpg1
%TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuympo[1].jpg1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\88c49765bcd66ee0d2c221b588ab9be2.png1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\6d53b4a093ebca0fb8cc392d7d555393.png1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\6b842260b54597a2854d59021c18212e.png1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\67a2edf11e6d7fe5a55ee1f628dbedac.png1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\245c17895f207fb069f2c3c7ac41b8d5.png1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\1ea29bcf0303b0b4f2a64ceb02d7a41b.png1
%LOCALAPPDATA%\microsoft\windows mail\edb00001.log1
%LOCALAPPDATA%\microsoft\windows mail\edb.log1
%LOCALAPPDATA%\microsoft\windows mail\stationery\psychedelic.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif1
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif1
%LOCALAPPDATA%\microsoft\windows mail\stationery\tanspecks.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif1
%LOCALAPPDATA%\microsoft\windows mail\stationery\stars.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\softblue.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\small_news.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\shadesofblue.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\sand_paper.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\white_chocolate.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\roses.jpg1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\aef45a65bd1f70e76562ca9fece4b548.png1
%TEMP%\adobearm_notlocked.log1
%TEMP%\msieb217.log1
%TEMP%\msie45bf.log1
%TEMP%\msid38c.log1
%TEMP%\msic204f.log1
%TEMP%\msi1cfbe.log1
%TEMP%\javadeployreg.log1
%TEMP%\adobe_admlogs\adobe_gde.log1
%TEMP%\adobe_admlogs\adobe_adm.log1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\c0846af91cea75e051954da0abc03311.png1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\bea36813740fc773f4a204eed648b56e.png1
%TEMP%\adobearm.log1
%TEMP%\aspnetsetup_00003.log1
%TEMP%\aspnetsetup_00002.log1
%TEMP%\aspnetsetup_00001.log1
%TEMP%\aspnetsetup_00000.log1
%TEMP%\aspnetsetup.log1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\e8d1fddb32d96418b8b3937f63753202.png1
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\e2b4ab9114a8eb2130be7e053b7505df.png1
%TEMP%\adobesfx.log1
%LOCALAPPDATA%\microsoft\windows mail\stationery\pretty_peacock.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\pine_lumber.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\peacock.jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\html5shiv-printshiv[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\helppage.min[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\gtm[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\f[3].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\f[2].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\f[1].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\e151e5[1].gif1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\icon-pay-qiwi[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\c4-5ab719-91cdfbc1[1].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\advertisement.ad[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\containertag[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\cc[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbumf59[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuz11l[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyw6y[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyvs0[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyugu[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\alarm-motors[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\icon-pay-yandex[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\icon-fav[1].svg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\icon-seen[1].svg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\orangecircles.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\bears.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\notebook.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\monet.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\handprints.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\greenbubbles.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\garden.jpg1
%LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif1
%LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif1
%LOCALAPPDATA%\microsoft\windows mail\stationery\blue_gradient.jpg1
%LOCALAPPDATA%\microsoft\windows mail\backup\new\edb00001.log1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\logo-15x15[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\shogo-logo[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\satellite-534da2e96b8ae7c6840004b9[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\region_black[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\p[1].gif1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\new-feature-14[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\new-feature-12[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\mg4_wmp12_30x30_2[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\media_guide_16x16[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\y90[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuy5ey[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\wmp_16x16[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyevi[1].jpg1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_sr.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_32.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_256.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1024.db1
%LOCALAPPDATA%\microsoft\windows\caches\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000004d.db1
%LOCALAPPDATA%\microsoft\windows\caches\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000004c.db1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\topbar_floating_button_maximize.png1
%LOCALAPPDATA%\microsoft\windows\caches\cversions.1.db1
%LOCALAPPDATA%\microsoft\media player\art cache\localmls\{e0b059b4-a85d-44bf-91bb-c9f4d9056b6e}.jpg1
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt1
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak1
%LOCALAPPDATA%\iconcache.db1
%LOCALAPPDATA%\google\chrome\user data\chrome_shutdown_ms.txt1
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db1
%LOCALAPPDATA%\google\chrome\user data\default\session storage\000010.log1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\128.png1
%LOCALAPPDATA%\microsoft\media player\art cache\localmls\{f4a8fc3a-8cdf-4002-b302-ab80b8408a6e}.jpg1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\topbar_floating_button_pressed.png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\aa3d297[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuol3s[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyc5q[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuya1q[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuxswl[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbux3vw[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuwpxg[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuwlnh[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuwkxi[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuv6aq[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\aa5jgeh[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\aa4umnj[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuleo1[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbu6lok[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbqqgih[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbmjdzf[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbmjpoi[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbm6e1t[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbitlpw[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbgcqj0[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuscuy[1].jpg1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\topbar_floating_button_hover.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\topbar_floating_button_close.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\topbar_floating_button.png1
C:\users\public\pictures\sample pictures\lighthouse.jpg1
C:\users\public\pictures\sample pictures\koala.jpg1
C:\users\public\pictures\sample pictures\jellyfish.jpg1
C:\users\public\pictures\sample pictures\hydrangeas.jpg1
C:\users\public\pictures\sample pictures\desert.jpg1
C:\users\public\pictures\sample pictures\chrysanthemum.jpg1
C:\users\public\music\sample music\sleep away.mp31
C:\users\public\pictures\sample pictures\tulips.jpg1
C:\users\public\music\sample music\maid with the flaxen hair.mp31
C:\users\public\music\sample music\folder.jpg1
C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_small.jpg1
C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_large.jpg1
C:\users\public\music\sample music\albumartsmall.jpg1
%HOMEPATH%\desktop\readme_readme_readme.txt
C:\users\public\desktop\readme_readme_readme.txt
C:\users\default\desktop\readme_readme_readme.txt
D:\readme_readme_readme.txt
C:\users\public\music\sample music\kalimba.mp31
C:\users\public\videos\sample videos\wildlife.wmv1
C:\users\public\pictures\sample pictures\penguins.jpg1
%LOCALAPPDATA%\google\chrome\user data\default\extension state\000007.log1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\icon_16.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\32.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\icon_128.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\flapper.gif1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\craw_window.js1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\craw_background.js1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\main.js1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\icon_16.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\icon_128.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\48.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\16.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\128.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\128.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\128.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.js1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_16.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\main.js1
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_16.png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuycnv[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyf9e[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\satellite-5359ac4ecd812179a60007a7[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyjt3[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuj4f2[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuz6un[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuz3bh[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuz1ts[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuytwm[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuypej[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuyeer[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuy1cg[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuq9ng[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuxbtw[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbux3pl[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuwj2j[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuwaqy[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuvwr8[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuuydc[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbutmft[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbusfcz[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bburxvs[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbux9ih[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuqvcd[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\analytics[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\lang_def[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\respond[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\region_blue[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\o71pjc8m6hh[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\new-feature-7[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\new-feature-4[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\new-feature-2[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\new-feature-10[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\menu-icon-7[1].svg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\connect[1].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\compiled[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\jquery-1.11.1.min[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\imslib.min[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\icon-compare[1].svg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\https.embed[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\globalnav[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\context_static_r1170[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\context[2].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\context[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\mbox-contents-f3808f72f280c66c15bd81363d6f55f0659a684d[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbugi8s[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbubusw[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbn9kvz[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\icon-pay-visa[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\icon-pay-alpha[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\homepage-intro-bike[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\gnav[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\f[2].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\f[1].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\dil-contents-fe044508f2e9fdd5937011e33188cb0afb585dac[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\ims[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\context_static_r1170[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\big_loader_white[1].gif1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\ast[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\containertag[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuw2el[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuvpx4[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuz46t[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuybrz[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuykez[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\connect[1].txt1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\media_guide_16x16[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\icon-pay-wallet[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\mg4_wmp12_30x30_2[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbn3zid[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aa42rsb[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bb8jywb[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bb5w6z3[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aafeso8[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aaepoj5[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aade8tz[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aad5gim[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aac0frj[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aa5gmcl[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aa2kh4d[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\p[1].gif1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\yoe7ink[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\y300[1].jpg1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\tracking[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\tile[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\search_button[1].png1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\satellite-54133e4209c7a707dc0001c5[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\respond[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\reimagined[1].js1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\watch[1].js1
%TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt1

Deletes the following files

%LOCALAPPDATA%\microsoft\windows\caches\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000004d.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1024.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_256.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_32.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db1
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_sr.db1

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im mysqld.exe & cd ../mysql5/bin/ & move /Y mysqld.exe mysqld.exe1"
'%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im mysqld.exe"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial