FOR USERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.PWS.Steam.18556

Added to the Dr.Web virus database: 2020-10-13

Virus description added:

Technical Information

Malicious functions
Reads files which store third party applications passwords
  • %ProgramFiles(x86)%\steam\config\config.vdf
  • %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
  • %LOCALAPPDATA%\google\chrome\user data\default\login data
  • %LOCALAPPDATA%\google\chrome\user data\default\cookies
  • %LOCALAPPDATA%\google\chrome\user data\default\web data
  • %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
  • %TEMP%\tmpa91a.tmp
  • %TEMP%\tmp2642.tmp
  • %TEMP%\tmp2653.tmp
  • %TEMP%\tmp2654.tmp
  • %TEMP%\tmp2655.tmp
  • %TEMP%\tmp2666.tmp
  • %TEMP%\tmp2667.tmp
  • %TEMP%\tmp2668.tmp
  • %TEMP%\tmp2669.tmp
  • %TEMP%\tmp2679.tmp
  • %TEMP%\tmp267a.tmp
  • %TEMP%\tmp268b.tmp
  • %TEMP%\tmp268c.tmp
  • %TEMP%\tmp269c.tmp
  • %TEMP%\tmp269d.tmp
  • %TEMP%\tmp269e.tmp
  • %TEMP%\tmp269f.tmp
  • %TEMP%\tmp26b0.tmp
  • %TEMP%\tmp26b1.tmp
  • %TEMP%\tmp26b2.tmp
  • %TEMP%\tmp26c3.tmp
  • %TEMP%\tmp26c4.tmp
  • %TEMP%\tmp2641.tmp
  • %TEMP%\tmp280e.tmp
  • %TEMP%\tmp2640.tmp
  • %TEMP%\tmp262f.tmp
  • %TEMP%\tmp259d.tmp
  • %TEMP%\tmp25ae.tmp
  • %TEMP%\tmp25be.tmp
  • %TEMP%\tmp25bf.tmp
  • %TEMP%\tmp25c0.tmp
  • %TEMP%\tmp25d1.tmp
  • %TEMP%\tmp25d2.tmp
  • %TEMP%\tmp25d3.tmp
  • %TEMP%\tmp25d4.tmp
  • %TEMP%\tmp25e4.tmp
  • %TEMP%\tmp25e5.tmp
  • %TEMP%\tmp25e6.tmp
  • %TEMP%\tmp25f7.tmp
  • %TEMP%\tmp25f8.tmp
  • %TEMP%\tmp2609.tmp
  • %TEMP%\tmp260a.tmp
  • %TEMP%\tmp260b.tmp
  • %TEMP%\tmp261b.tmp
  • %TEMP%\tmp261c.tmp
  • %TEMP%\tmp262d.tmp
  • %TEMP%\tmp262e.tmp
  • %TEMP%\tmp263f.tmp
  • %TEMP%\tmp259c.tmp
  • %TEMP%\tmp259b.tmp
  • %TEMP%\tmp26d7.tmp
  • %TEMP%\tmp277e.tmp
  • %TEMP%\tmp277f.tmp
  • %TEMP%\tmp278f.tmp
  • %TEMP%\tmp2790.tmp
  • %TEMP%\tmp2791.tmp
  • %TEMP%\tmp2792.tmp
  • %TEMP%\tmp27a3.tmp
  • %TEMP%\tmp27a4.tmp
  • %TEMP%\tmp27a5.tmp
  • %TEMP%\tmp27b5.tmp
  • %TEMP%\tmp27b6.tmp
  • %TEMP%\tmp27b7.tmp
  • %TEMP%\tmp27c8.tmp
  • %TEMP%\tmp27c9.tmp
  • %TEMP%\tmp27da.tmp
  • %TEMP%\tmp27db.tmp
  • %TEMP%\tmp27dc.tmp
  • %TEMP%\tmp27dd.tmp
  • %TEMP%\tmp27ed.tmp
  • %TEMP%\tmp27ee.tmp
  • %TEMP%\tmp26d5.tmp
  • %TEMP%\tmp277d.tmp
  • %TEMP%\tmp26d6.tmp
  • %TEMP%\tmp277c.tmp
  • %TEMP%\tmp26d4.tmp
  • %TEMP%\tmp26e8.tmp
  • %TEMP%\tmp26e9.tmp
  • %TEMP%\tmp26ea.tmp
  • %TEMP%\tmp26fa.tmp
  • %TEMP%\tmp26fb.tmp
  • %TEMP%\tmp26fc.tmp
  • %TEMP%\tmp26fd.tmp
  • %TEMP%\tmp270e.tmp
  • %TEMP%\tmp270f.tmp
  • %TEMP%\tmp2710.tmp
  • %TEMP%\tmp2711.tmp
  • %TEMP%\tmp2731.tmp
  • %TEMP%\tmp2732.tmp
  • %TEMP%\tmp2733.tmp
  • %TEMP%\tmp2744.tmp
  • %TEMP%\tmp2745.tmp
  • %TEMP%\tmp2746.tmp
  • %TEMP%\tmp2756.tmp
  • %TEMP%\tmp2757.tmp
  • %TEMP%\tmp2768.tmp
  • %TEMP%\tmp2769.tmp
  • %TEMP%\tmp276b.tmp
  • %TEMP%\tmpe7c.tmp
  • %TEMP%\tmp276a.tmp
  • %TEMP%\tmp100d.tmp
  • %TEMP%\tmpf14.tmp
  • %TEMP%\tmpf15.tmp
  • %TEMP%\tmpf16.tmp
  • %TEMP%\tmpf27.tmp
  • %TEMP%\tmpf28.tmp
  • %TEMP%\tmpf29.tmp
  • %TEMP%\tmpf2a.tmp
  • %TEMP%\tmpf3a.tmp
  • %TEMP%\tmpf3b.tmp
  • %TEMP%\tmpf3c.tmp
  • %TEMP%\tmpf3d.tmp
  • %TEMP%\tmpf4e.tmp
  • %TEMP%\tmpf4f.tmp
  • %TEMP%\tmpf50.tmp
  • %TEMP%\tmpf60.tmp
  • %TEMP%\tmpf61.tmp
  • %TEMP%\tmpf62.tmp
  • %TEMP%\tmpf63.tmp
  • %TEMP%\tmpf93.tmp
  • %TEMP%\tmpf94.tmp
  • %TEMP%\tmpf95.tmp
  • %TEMP%\tmpf03.tmp
  • %TEMP%\tmp10a2.tmp
  • %TEMP%\tmpf02.tmp
  • %TEMP%\tmpf00.tmp
  • %TEMP%\tmpe7e.tmp
  • %TEMP%\tmpe8f.tmp
  • %TEMP%\tmpe90.tmp
  • %TEMP%\tmpe91.tmp
  • %TEMP%\tmpe92.tmp
  • %TEMP%\tmpea2.tmp
  • %TEMP%\tmpea3.tmp
  • %TEMP%\tmpea4.tmp
  • %TEMP%\tmpea5.tmp
  • %TEMP%\tmpeb6.tmp
  • %TEMP%\tmpeb7.tmp
  • %TEMP%\tmpeb8.tmp
  • %TEMP%\tmpec9.tmp
  • %TEMP%\tmpeca.tmp
  • %TEMP%\tmpeda.tmp
  • %TEMP%\tmpedb.tmp
  • %TEMP%\tmpedc.tmp
  • %TEMP%\tmpedd.tmp
  • %TEMP%\tmpeee.tmp
  • %TEMP%\tmpeef.tmp
  • %TEMP%\tmpef0.tmp
  • %TEMP%\tmpf01.tmp
  • %TEMP%\tmp258a.tmp
  • %TEMP%\tmp10b2.tmp
  • %TEMP%\tmpfa9.tmp
  • %TEMP%\tmp1020.tmp
  • %TEMP%\tmp1021.tmp
  • %TEMP%\tmp1032.tmp
  • %TEMP%\tmp1033.tmp
  • %TEMP%\tmp1034.tmp
  • %TEMP%\tmp1035.tmp
  • %TEMP%\tmp1046.tmp
  • %TEMP%\tmp1047.tmp
  • %TEMP%\tmp1048.tmp
  • %TEMP%\tmp1049.tmp
  • %TEMP%\tmp1059.tmp
  • %TEMP%\tmp105a.tmp
  • %TEMP%\tmp105b.tmp
  • %TEMP%\tmp105c.tmp
  • %TEMP%\tmp106d.tmp
  • %TEMP%\tmp107d.tmp
  • %TEMP%\tmp107e.tmp
  • %TEMP%\tmp107f.tmp
  • %TEMP%\tmp1090.tmp
  • %TEMP%\tmp1091.tmp
  • %TEMP%\tmpfa7.tmp
  • %TEMP%\tmp101f.tmp
  • %TEMP%\tmpfa8.tmp
  • %TEMP%\tmp101e.tmp
  • %TEMP%\tmpf96.tmp
  • %TEMP%\tmpfaa.tmp
  • %TEMP%\tmpfab.tmp
  • %TEMP%\tmpfbb.tmp
  • %TEMP%\tmpfbc.tmp
  • %TEMP%\tmpfbd.tmp
  • %TEMP%\tmpfce.tmp
  • %TEMP%\tmpfcf.tmp
  • %TEMP%\tmpfd0.tmp
  • %TEMP%\tmpfd1.tmp
  • %TEMP%\tmpfe2.tmp
  • %TEMP%\tmpfe3.tmp
  • %TEMP%\tmpfe4.tmp
  • %TEMP%\tmpfe5.tmp
  • %TEMP%\tmpff5.tmp
  • %TEMP%\tmpff6.tmp
  • %TEMP%\tmpff7.tmp
  • %TEMP%\tmpff8.tmp
  • %TEMP%\tmpff9.tmp
  • %TEMP%\tmp100a.tmp
  • %TEMP%\tmp100b.tmp
  • %TEMP%\tmp100c.tmp
  • %TEMP%\tmp100e.tmp
  • %TEMP%\tmpe7d.tmp
  • %TEMP%\tmp281f.tmp
  • %TEMP%\tmp43be.tmp
  • %TEMP%\tmp5ba1.tmp
  • %TEMP%\tmp5ba2.tmp
  • %TEMP%\tmp5bb3.tmp
  • %TEMP%\tmp5bb4.tmp
  • %TEMP%\tmp5bb5.tmp
  • %TEMP%\tmp5bb6.tmp
  • %TEMP%\tmp5bc6.tmp
  • %TEMP%\tmp5bc7.tmp
  • %TEMP%\tmp5bc8.tmp
  • %TEMP%\tmp5bd9.tmp
  • %TEMP%\tmp5bda.tmp
  • %TEMP%\tmp5bdb.tmp
  • %TEMP%\tmp5bec.tmp
  • %TEMP%\tmp5bed.tmp
  • %TEMP%\tmp5c0d.tmp
  • %TEMP%\tmp5c0e.tmp
  • %TEMP%\tmp5c0f.tmp
  • %TEMP%\tmp5c10.tmp
  • %TEMP%\tmp5c20.tmp
  • %TEMP%\tmp5c21.tmp
  • %TEMP%\tmp5c22.tmp
  • %TEMP%\tmp5ba0.tmp
  • %TEMP%\tmp5b09.tmp
  • %TEMP%\tmp5b9f.tmp
  • %TEMP%\tmp5b8e.tmp
  • %TEMP%\tmp5b0b.tmp
  • %TEMP%\tmp5b1c.tmp
  • %TEMP%\tmp5b1d.tmp
  • %TEMP%\tmp5b1e.tmp
  • %TEMP%\tmp5b2f.tmp
  • %TEMP%\tmp5b30.tmp
  • %TEMP%\tmp5b31.tmp
  • %TEMP%\tmp5b32.tmp
  • %TEMP%\tmp5b42.tmp
  • %TEMP%\tmp5b43.tmp
  • %TEMP%\tmp5b44.tmp
  • %TEMP%\tmp5b55.tmp
  • %TEMP%\tmp5b56.tmp
  • %TEMP%\tmp5b57.tmp
  • %TEMP%\tmp5b67.tmp
  • %TEMP%\tmp5b68.tmp
  • %TEMP%\tmp5b69.tmp
  • %TEMP%\tmp5b7a.tmp
  • %TEMP%\tmp5b7b.tmp
  • %TEMP%\tmp5b7c.tmp
  • %TEMP%\tmp5b8d.tmp
  • %TEMP%\tmp5b8f.tmp
  • %TEMP%\tmp5b0a.tmp
  • %TEMP%\tmp5c33.tmp
  • %TEMP%\tmp5c37.tmp
  • %TEMP%\tmp5cae.tmp
  • %TEMP%\tmp5caf.tmp
  • %TEMP%\tmp5cbf.tmp
  • %TEMP%\tmp5cc0.tmp
  • %TEMP%\tmp5cc1.tmp
  • %TEMP%\tmp5cc2.tmp
  • %TEMP%\tmp5cd3.tmp
  • %TEMP%\tmp5cd4.tmp
  • %TEMP%\tmp5cd5.tmp
  • %TEMP%\tmpded6.tmp
  • %TEMP%\tmp5cd6.tmp
  • %TEMP%\tmp5ce7.tmp
  • %TEMP%\tmp5ce8.tmp
  • %TEMP%\tmp5ce9.tmp
  • %TEMP%\tmp5cea.tmp
  • %TEMP%\tmp5cfb.tmp
  • %TEMP%\tmp5cfc.tmp
  • %TEMP%\tmp5cfd.tmp
  • %TEMP%\tmp5cfe.tmp
  • %TEMP%\tmp5d0f.tmp
  • %TEMP%\tmp5cac.tmp
  • %TEMP%\tmp5cad.tmp
  • %TEMP%\tmp5c35.tmp
  • %TEMP%\tmp5c34.tmp
  • %TEMP%\tmp5c99.tmp
  • %TEMP%\tmp5c48.tmp
  • %TEMP%\tmp5c49.tmp
  • %TEMP%\tmp5c4a.tmp
  • %TEMP%\tmp5c4b.tmp
  • %TEMP%\tmp5c4c.tmp
  • %TEMP%\tmp5c5c.tmp
  • %TEMP%\tmp5c5d.tmp
  • %TEMP%\tmp5c5e.tmp
  • %TEMP%\tmp5c5f.tmp
  • %TEMP%\tmp5c70.tmp
  • %TEMP%\tmp5c71.tmp
  • %TEMP%\tmp5c72.tmp
  • %TEMP%\tmp5c73.tmp
  • %TEMP%\tmp5c74.tmp
  • %TEMP%\tmp5c84.tmp
  • %TEMP%\tmp5c85.tmp
  • %TEMP%\tmp5c86.tmp
  • %TEMP%\tmp5c97.tmp
  • %TEMP%\tmp5c98.tmp
  • %TEMP%\tmp5c9a.tmp
  • %TEMP%\tmp5c36.tmp
  • %TEMP%\tmp5c9b.tmp
  • %TEMP%\tmp43ac.tmp
  • %TEMP%\tmp43ab.tmp
  • %TEMP%\tmp45e1.tmp
  • %TEMP%\tmp4455.tmp
  • %TEMP%\tmp4456.tmp
  • %TEMP%\tmp4457.tmp
  • %TEMP%\tmp4467.tmp
  • %TEMP%\tmp4468.tmp
  • %TEMP%\tmp4469.tmp
  • %TEMP%\tmp446a.tmp
  • %TEMP%\tmp447b.tmp
  • %TEMP%\tmp448b.tmp
  • %TEMP%\tmp448c.tmp
  • %TEMP%\tmp448d.tmp
  • %TEMP%\tmp448e.tmp
  • %TEMP%\tmp449f.tmp
  • %TEMP%\tmp44a0.tmp
  • %TEMP%\tmp44a1.tmp
  • %TEMP%\tmp44b2.tmp
  • %TEMP%\tmp44b3.tmp
  • %TEMP%\tmp44b4.tmp
  • %TEMP%\tmp44e3.tmp
  • %TEMP%\tmp4442.tmp
  • %TEMP%\tmp4441.tmp
  • %TEMP%\tmp4454.tmp
  • %TEMP%\tmp4443.tmp
  • %TEMP%\tmp44e4.tmp
  • %TEMP%\tmp45e2.tmp
  • %TEMP%\tmp43bf.tmp
  • %TEMP%\tmp43c0.tmp
  • %TEMP%\tmp43c1.tmp
  • %TEMP%\tmp43d1.tmp
  • %TEMP%\tmp43d2.tmp
  • %TEMP%\tmp43d3.tmp
  • %TEMP%\tmp43e4.tmp
  • %TEMP%\tmp43e5.tmp
  • %TEMP%\tmp43e6.tmp
  • %TEMP%\tmp43f7.tmp
  • %TEMP%\tmp43f8.tmp
  • %TEMP%\tmp43f9.tmp
  • %TEMP%\tmp43fa.tmp
  • %TEMP%\tmp440a.tmp
  • %TEMP%\tmp441b.tmp
  • %TEMP%\tmp441c.tmp
  • %TEMP%\tmp441d.tmp
  • %TEMP%\tmp442d.tmp
  • %TEMP%\tmp442e.tmp
  • %TEMP%\tmp4440.tmp
  • %TEMP%\tmp43ad.tmp
  • %TEMP%\tmp442f.tmp
  • %TEMP%\tmp5af9.tmp
  • %TEMP%\tmp44e5.tmp
  • %TEMP%\tmp44f9.tmp
  • %TEMP%\tmp4571.tmp
  • %TEMP%\tmp4572.tmp
  • %TEMP%\tmp4573.tmp
  • %TEMP%\tmp4583.tmp
  • %TEMP%\tmp4584.tmp
  • %TEMP%\tmp4585.tmp
  • %TEMP%\tmp4586.tmp
  • %TEMP%\tmp4597.tmp
  • %TEMP%\tmp4598.tmp
  • %TEMP%\tmp4599.tmp
  • %TEMP%\tmp459a.tmp
  • %TEMP%\tmp459b.tmp
  • %TEMP%\tmp45ab.tmp
  • %TEMP%\tmp45ac.tmp
  • %TEMP%\tmp45ad.tmp
  • %TEMP%\tmp45ae.tmp
  • %TEMP%\tmp45bf.tmp
  • %TEMP%\tmp45c0.tmp
  • %TEMP%\tmp45c1.tmp
  • %TEMP%\tmp455e.tmp
  • %TEMP%\tmp455d.tmp
  • %TEMP%\tmp4570.tmp
  • %TEMP%\tmp455f.tmp
  • %TEMP%\tmp44e6.tmp
  • %TEMP%\tmp44f7.tmp
  • %TEMP%\tmp44fa.tmp
  • %TEMP%\tmp44fb.tmp
  • %TEMP%\tmp450c.tmp
  • %TEMP%\tmp450d.tmp
  • %TEMP%\tmp450e.tmp
  • %TEMP%\tmp450f.tmp
  • %TEMP%\tmp451f.tmp
  • %TEMP%\tmp4520.tmp
  • %TEMP%\tmp4521.tmp
  • %TEMP%\tmp4522.tmp
  • %TEMP%\tmp4523.tmp
  • %TEMP%\tmp4534.tmp
  • %TEMP%\tmp4535.tmp
  • %TEMP%\tmp4536.tmp
  • %TEMP%\tmp4537.tmp
  • %TEMP%\tmp4547.tmp
  • %TEMP%\tmp4548.tmp
  • %TEMP%\tmp4549.tmp
  • %TEMP%\tmp454a.tmp
  • %TEMP%\tmp455c.tmp
  • %TEMP%\tmp44f8.tmp
  • %TEMP%\tmp454b.tmp
  • %TEMP%\tmpe6c.tmp
  • %TEMP%\tmpf6f4.tmp
  • %TEMP%\tmpf6e4.tmp
  • %TEMP%\tmpc524.tmp
  • %TEMP%\tmpc535.tmp
  • %TEMP%\tmpc536.tmp
  • %TEMP%\tmpc537.tmp
  • %TEMP%\tmpc548.tmp
  • %TEMP%\tmpc549.tmp
  • %TEMP%\tmpc54a.tmp
  • %TEMP%\tmpc55a.tmp
  • %TEMP%\tmpc55b.tmp
  • %TEMP%\tmpc55c.tmp
  • %TEMP%\tmpc56d.tmp
  • %TEMP%\tmpc56e.tmp
  • %TEMP%\tmpc56f.tmp
  • %TEMP%\tmpc57f.tmp
  • %TEMP%\tmpc580.tmp
  • %TEMP%\tmpc581.tmp
  • %TEMP%\tmpc582.tmp
  • %TEMP%\tmpc593.tmp
  • %TEMP%\tmpc594.tmp
  • %TEMP%\tmpc595.tmp
  • %TEMP%\tmpc513.tmp
  • %TEMP%\tmpc5b5.tmp
  • %TEMP%\tmpc512.tmp
  • %TEMP%\tmpc4f1.tmp
  • %TEMP%\tmpc46e.tmp
  • %TEMP%\tmpc46f.tmp
  • %TEMP%\tmpc480.tmp
  • %TEMP%\tmpc481.tmp
  • %TEMP%\tmpc482.tmp
  • %TEMP%\tmpc483.tmp
  • %TEMP%\tmpc494.tmp
  • %TEMP%\tmpc495.tmp
  • %TEMP%\tmpc496.tmp
  • %TEMP%\tmpc4a6.tmp
  • %TEMP%\tmpc4a7.tmp
  • %TEMP%\tmpc4a8.tmp
  • %TEMP%\tmpc4b9.tmp
  • %TEMP%\tmpc4ba.tmp
  • %TEMP%\tmpc4bb.tmp
  • %TEMP%\tmpc4cb.tmp
  • %TEMP%\tmpc4dc.tmp
  • %TEMP%\tmpc4dd.tmp
  • %TEMP%\tmpc4de.tmp
  • %TEMP%\tmpc4df.tmp
  • %TEMP%\tmpc4f0.tmp
  • %TEMP%\tmpc501.tmp
  • %TEMP%\tmpc46d.tmp
  • %TEMP%\tmpc6b2.tmp
  • %TEMP%\tmpabbe.tmp
  • %TEMP%\tmpc63f.tmp
  • %TEMP%\tmpc640.tmp
  • %TEMP%\tmpc651.tmp
  • %TEMP%\tmpc652.tmp
  • %TEMP%\tmpc653.tmp
  • %TEMP%\tmpc664.tmp
  • %TEMP%\tmpc665.tmp
  • %TEMP%\tmpc666.tmp
  • %TEMP%\tmpc676.tmp
  • %TEMP%\tmpc677.tmp
  • %TEMP%\tmpc678.tmp
  • %TEMP%\tmpc679.tmp
  • %TEMP%\tmpc68a.tmp
  • %TEMP%\tmpc68b.tmp
  • %TEMP%\tmpc68c.tmp
  • %TEMP%\tmpc68d.tmp
  • %TEMP%\tmpc69d.tmp
  • %TEMP%\tmpc69e.tmp
  • %TEMP%\tmpc69f.tmp
  • %TEMP%\tmpc6b0.tmp
  • %TEMP%\tmpc6b1.tmp
  • %TEMP%\tmpc63e.tmp
  • %TEMP%\tmpc5c7.tmp
  • %TEMP%\tmpc5c6.tmp
  • %TEMP%\tmpc63b.tmp
  • %TEMP%\tmpc5c9.tmp
  • %TEMP%\tmpc5ca.tmp
  • %TEMP%\tmpc5cb.tmp
  • %TEMP%\tmpc5db.tmp
  • %TEMP%\tmpc5dc.tmp
  • %TEMP%\tmpc5dd.tmp
  • %TEMP%\tmpc5ee.tmp
  • %TEMP%\tmpc5ef.tmp
  • %TEMP%\tmpc5f0.tmp
  • %TEMP%\tmpc601.tmp
  • %TEMP%\tmpc602.tmp
  • %TEMP%\tmpc603.tmp
  • %TEMP%\tmpc604.tmp
  • %TEMP%\tmpc614.tmp
  • %TEMP%\tmpc615.tmp
  • %TEMP%\tmpc616.tmp
  • %TEMP%\tmpc617.tmp
  • %TEMP%\tmpc628.tmp
  • %TEMP%\tmpc629.tmp
  • %TEMP%\tmpc62a.tmp
  • %TEMP%\tmpc62b.tmp
  • %TEMP%\tmpc63c.tmp
  • %TEMP%\tmpc5c8.tmp
  • %TEMP%\tmpc63d.tmp
  • %TEMP%\tmpab9d.tmp
  • %TEMP%\tmpab19.tmp
  • %TEMP%\tmpaa1f.tmp
  • %TEMP%\tmpaa30.tmp
  • %TEMP%\tmpaa31.tmp
  • %TEMP%\tmpaa32.tmp
  • %TEMP%\tmpaa33.tmp
  • %TEMP%\tmpaa43.tmp
  • %TEMP%\tmpaa44.tmp
  • %TEMP%\tmpaa45.tmp
  • %TEMP%\tmpaa46.tmp
  • %TEMP%\tmpaa57.tmp
  • %TEMP%\tmpaa58.tmp
  • %TEMP%\tmpaa59.tmp
  • %TEMP%\tmpaa6a.tmp
  • %TEMP%\tmpaa6b.tmp
  • %TEMP%\tmpaa7b.tmp
  • %TEMP%\tmpaa7c.tmp
  • %TEMP%\tmpaa7d.tmp
  • %TEMP%\tmpaa8e.tmp
  • %TEMP%\tmpaa8f.tmp
  • %TEMP%\tmpaa90.tmp
  • %TEMP%\tmpaa1d.tmp
  • %TEMP%\tmpaa91.tmp
  • %TEMP%\tmpaa1c.tmp
  • %TEMP%\tmpaa0b.tmp
  • %TEMP%\tmpa92b.tmp
  • %TEMP%\tmpa96a.tmp
  • %TEMP%\tmpa96b.tmp
  • %TEMP%\tmpa96c.tmp
  • %TEMP%\tmpa96d.tmp
  • %TEMP%\tmpa97e.tmp
  • %TEMP%\tmpa97f.tmp
  • %TEMP%\tmpa98f.tmp
  • %TEMP%\tmpa990.tmp
  • %TEMP%\tmpa991.tmp
  • %TEMP%\tmpa9a2.tmp
  • %TEMP%\tmpa9a3.tmp
  • %TEMP%\tmpa9b4.tmp
  • %TEMP%\tmpa9c4.tmp
  • %TEMP%\tmpa9c5.tmp
  • %TEMP%\tmpa9d6.tmp
  • %TEMP%\tmpa9e6.tmp
  • %TEMP%\tmpa9e7.tmp
  • %TEMP%\tmpa9f8.tmp
  • %TEMP%\tmpa9f9.tmp
  • %TEMP%\tmpa9fa.tmp
  • %TEMP%\tmpaa0c.tmp
  • %TEMP%\tmpabbd.tmp
  • %TEMP%\tmpc6d2.tmp
  • %TEMP%\tmpaa1e.tmp
  • %TEMP%\tmpab2b.tmp
  • %TEMP%\tmpab2c.tmp
  • %TEMP%\tmpab2d.tmp
  • %TEMP%\tmpab2e.tmp
  • %TEMP%\tmpab3e.tmp
  • %TEMP%\tmpab3f.tmp
  • %TEMP%\tmpab40.tmp
  • %TEMP%\tmpab41.tmp
  • %TEMP%\tmpab52.tmp
  • %TEMP%\tmpab53.tmp
  • %TEMP%\tmpab54.tmp
  • %TEMP%\tmpab55.tmp
  • %TEMP%\tmpab65.tmp
  • %TEMP%\tmpab66.tmp
  • %TEMP%\tmpab67.tmp
  • %TEMP%\tmpab68.tmp
  • %TEMP%\tmpab79.tmp
  • %TEMP%\tmpab7a.tmp
  • %TEMP%\tmpab7b.tmp
  • %TEMP%\tmpab7c.tmp
  • %TEMP%\tmpab8d.tmp
  • %TEMP%\tmpab1a.tmp
  • %TEMP%\tmpaaa2.tmp
  • %TEMP%\tmpaaa1.tmp
  • %TEMP%\tmpab17.tmp
  • %TEMP%\tmpaab4.tmp
  • %TEMP%\tmpaab5.tmp
  • %TEMP%\tmpaab6.tmp
  • %TEMP%\tmpaab7.tmp
  • %TEMP%\tmpaac8.tmp
  • %TEMP%\tmpaac9.tmp
  • %TEMP%\tmpaaca.tmp
  • %TEMP%\tmpaacb.tmp
  • %TEMP%\tmpaadb.tmp
  • %TEMP%\tmpaadc.tmp
  • %TEMP%\tmpaadd.tmp
  • %TEMP%\tmpaaee.tmp
  • %TEMP%\tmpaaef.tmp
  • %TEMP%\tmpaaf0.tmp
  • %TEMP%\tmpaaf1.tmp
  • %TEMP%\tmpaaf2.tmp
  • %TEMP%\tmpab02.tmp
  • %TEMP%\tmpab03.tmp
  • %TEMP%\tmpab04.tmp
  • %TEMP%\tmpab05.tmp
  • %TEMP%\tmpab16.tmp
  • %TEMP%\tmpab18.tmp
  • %TEMP%\tmpaaa3.tmp
  • %TEMP%\tmpc514.tmp
  • %TEMP%\tmpc6d3.tmp
  • %TEMP%\tmpf536.tmp
  • %TEMP%\tmpf548.tmp
  • %TEMP%\tmpf549.tmp
  • %TEMP%\tmpf559.tmp
  • %TEMP%\tmpf55a.tmp
  • %TEMP%\tmpf55b.tmp
  • %TEMP%\tmpf56c.tmp
  • %TEMP%\tmpf56d.tmp
  • %TEMP%\tmpf56e.tmp
  • %TEMP%\tmpf56f.tmp
  • %TEMP%\tmpf57f.tmp
  • %TEMP%\tmpf580.tmp
  • %TEMP%\tmpf581.tmp
  • %TEMP%\tmpf592.tmp
  • %TEMP%\tmpf593.tmp
  • %TEMP%\tmpf594.tmp
  • %TEMP%\tmpf595.tmp
  • %TEMP%\tmpf5a6.tmp
  • %TEMP%\tmpf5a7.tmp
  • %TEMP%\tmpf5a8.tmp
  • %TEMP%\tmpf535.tmp
  • %TEMP%\tmpf524.tmp
  • %TEMP%\tmpf537.tmp
  • %TEMP%\tmpdfa7.tmp
  • %TEMP%\tmpf5b8.tmp
  • %TEMP%\tmpf49f.tmp
  • %TEMP%\tmpf4b2.tmp
  • %TEMP%\tmpf4b3.tmp
  • %TEMP%\tmpf4c3.tmp
  • %TEMP%\tmpf4c4.tmp
  • %TEMP%\tmpf4c5.tmp
  • %TEMP%\tmpf4c6.tmp
  • %TEMP%\tmpf4d7.tmp
  • %TEMP%\tmpf4d8.tmp
  • %TEMP%\tmpf4d9.tmp
  • %TEMP%\tmpf4ea.tmp
  • %TEMP%\tmpf4eb.tmp
  • %TEMP%\tmpf4ec.tmp
  • %TEMP%\tmpf4ed.tmp
  • %TEMP%\tmpf4fd.tmp
  • %TEMP%\tmpf4fe.tmp
  • %TEMP%\tmpf4ff.tmp
  • %TEMP%\tmpf510.tmp
  • %TEMP%\tmpf511.tmp
  • %TEMP%\tmpf512.tmp
  • %TEMP%\tmpf523.tmp
  • %TEMP%\tmpf4a0.tmp
  • %TEMP%\tmpf522.tmp
  • %TEMP%\tmpf4b1.tmp
  • %TEMP%\tmpf5b9.tmp
  • %TEMP%\tmpf5cd.tmp
  • %TEMP%\tmpf654.tmp
  • %TEMP%\tmpf665.tmp
  • %TEMP%\tmpf666.tmp
  • %TEMP%\tmpf667.tmp
  • %TEMP%\tmpf677.tmp
  • %TEMP%\tmpf678.tmp
  • %TEMP%\tmpf679.tmp
  • %TEMP%\tmpf68a.tmp
  • %TEMP%\tmpf68b.tmp
  • %TEMP%\tmpf69b.tmp
  • %TEMP%\tmpf69c.tmp
  • %TEMP%\tmpf69d.tmp
  • %TEMP%\tmpf6ae.tmp
  • %TEMP%\tmpf6af.tmp
  • %TEMP%\tmpf6b0.tmp
  • %TEMP%\tmpf6c1.tmp
  • %TEMP%\tmpf6c2.tmp
  • %TEMP%\tmpf6c3.tmp
  • %TEMP%\tmpf6d3.tmp
  • %TEMP%\tmpf641.tmp
  • %TEMP%\tmpf640.tmp
  • %TEMP%\tmpf653.tmp
  • %TEMP%\tmpf642.tmp
  • %TEMP%\tmpf5ba.tmp
  • %TEMP%\tmpf5bb.tmp
  • %TEMP%\tmpf5ce.tmp
  • %TEMP%\tmpf5cf.tmp
  • %TEMP%\tmpf5df.tmp
  • %TEMP%\tmpf5e0.tmp
  • %TEMP%\tmpf5e1.tmp
  • %TEMP%\tmpf5e2.tmp
  • %TEMP%\tmpf5f3.tmp
  • %TEMP%\tmpf5f4.tmp
  • %TEMP%\tmpf5f5.tmp
  • %TEMP%\tmpf5f6.tmp
  • %TEMP%\tmpf607.tmp
  • %TEMP%\tmpf608.tmp
  • %TEMP%\tmpf609.tmp
  • %TEMP%\tmpf619.tmp
  • %TEMP%\tmpf61a.tmp
  • %TEMP%\tmpf61b.tmp
  • %TEMP%\tmpf62c.tmp
  • %TEMP%\tmpf62d.tmp
  • %TEMP%\tmpf62e.tmp
  • %TEMP%\tmpf630.tmp
  • %TEMP%\tmpf5cc.tmp
  • %TEMP%\tmpf62f.tmp
  • %TEMP%\tmpf48f.tmp
  • %TEMP%\tmpdf96.tmp
  • %TEMP%\tmpdd60.tmp
  • %TEMP%\tmpde08.tmp
  • %TEMP%\tmpde09.tmp
  • %TEMP%\tmpde19.tmp
  • %TEMP%\tmpde1a.tmp
  • %TEMP%\tmpde1b.tmp
  • %TEMP%\tmpde1c.tmp
  • %TEMP%\tmpde3c.tmp
  • %TEMP%\tmpde3d.tmp
  • %TEMP%\tmpde4e.tmp
  • %TEMP%\tmpde4f.tmp
  • %TEMP%\tmpde50.tmp
  • %TEMP%\tmpde61.tmp
  • %TEMP%\tmpde62.tmp
  • %TEMP%\tmpde63.tmp
  • %TEMP%\tmpde64.tmp
  • %TEMP%\tmpde74.tmp
  • %TEMP%\tmpde75.tmp
  • %TEMP%\tmpde76.tmp
  • %TEMP%\tmpde87.tmp
  • %TEMP%\tmpde88.tmp
  • %TEMP%\tmpddf6.tmp
  • %TEMP%\tmpde89.tmp
  • %TEMP%\tmpddf5.tmp
  • %TEMP%\tmpdde3.tmp
  • %TEMP%\tmpdd71.tmp
  • %TEMP%\tmpdd72.tmp
  • %TEMP%\tmpdd73.tmp
  • %TEMP%\tmpdd74.tmp
  • %TEMP%\tmpdd84.tmp
  • %TEMP%\tmpdd85.tmp
  • %TEMP%\tmpdd86.tmp
  • %TEMP%\tmpdd97.tmp
  • %TEMP%\tmpdd98.tmp
  • %TEMP%\tmpdd99.tmp
  • %TEMP%\tmpddaa.tmp
  • %TEMP%\tmpddab.tmp
  • %TEMP%\tmpddac.tmp
  • %TEMP%\tmpddad.tmp
  • %TEMP%\tmpddbd.tmp
  • %TEMP%\tmpddbe.tmp
  • %TEMP%\tmpddbf.tmp
  • %TEMP%\tmpddd0.tmp
  • %TEMP%\tmpddd1.tmp
  • %TEMP%\tmpddd2.tmp
  • %TEMP%\tmpdde2.tmp
  • %TEMP%\tmpdde4.tmp
  • %TEMP%\tmpde99.tmp
  • %TEMP%\tmpddf7.tmp
  • %TEMP%\tmpde9a.tmp
  • %TEMP%\tmpdf24.tmp
  • %TEMP%\tmpdf26.tmp
  • %TEMP%\tmpdf36.tmp
  • %TEMP%\tmpdf37.tmp
  • %TEMP%\tmpdf38.tmp
  • %TEMP%\tmpdf39.tmp
  • %TEMP%\tmpdf4a.tmp
  • %TEMP%\tmpdf4b.tmp
  • %TEMP%\tmpdf4c.tmp
  • %TEMP%\tmpdf4d.tmp
  • %TEMP%\tmpdf4e.tmp
  • %TEMP%\tmpdf5e.tmp
  • %TEMP%\tmpdf5f.tmp
  • %TEMP%\tmpdf60.tmp
  • %TEMP%\tmpdf71.tmp
  • %TEMP%\tmpdf72.tmp
  • %TEMP%\tmpdf73.tmp
  • %TEMP%\tmpdf74.tmp
  • %TEMP%\tmpdf75.tmp
  • %TEMP%\tmpdf86.tmp
  • %TEMP%\tmpdf23.tmp
  • %TEMP%\tmpdf21.tmp
  • %TEMP%\tmpdf25.tmp
  • %TEMP%\tmpdf22.tmp
  • %TEMP%\tmpdf10.tmp
  • %TEMP%\tmpde9b.tmp
  • %TEMP%\tmpde9d.tmp
  • %TEMP%\tmpdeae.tmp
  • %TEMP%\tmpdeaf.tmp
  • %TEMP%\tmpdeb0.tmp
  • %TEMP%\tmpdeb1.tmp
  • %TEMP%\tmpdec2.tmp
  • %TEMP%\tmpdec3.tmp
  • %TEMP%\tmpdec4.tmp
  • %TEMP%\tmpdec5.tmp
  • %TEMP%\tmp5d1f.tmp
  • %TEMP%\tmp5cd7.tmp
  • %TEMP%\tmpdec6.tmp
  • %TEMP%\tmpded8.tmp
  • %TEMP%\tmpded9.tmp
  • %TEMP%\tmpdeea.tmp
  • %TEMP%\tmpdeeb.tmp
  • %TEMP%\tmpdeec.tmp
  • %TEMP%\tmpdeed.tmp
  • %TEMP%\tmpdefd.tmp
  • %TEMP%\tmpdefe.tmp
  • %TEMP%\tmpdf0f.tmp
  • %TEMP%\tmpde9c.tmp
  • %TEMP%\tmpded7.tmp
  • %TEMP%\tmp5d30.tmp
Deletes the following files
  • %TEMP%\tmpa92b.tmp
  • %TEMP%\tmp26d4.tmp
  • %TEMP%\tmp26c3.tmp
  • %TEMP%\tmp26b1.tmp
  • %TEMP%\tmp269f.tmp
  • %TEMP%\tmp269d.tmp
  • %TEMP%\tmp268c.tmp
  • %TEMP%\tmp267a.tmp
  • %TEMP%\tmp2669.tmp
  • %TEMP%\tmp2667.tmp
  • %TEMP%\tmp2655.tmp
  • %TEMP%\tmp280e.tmp
  • %TEMP%\tmp2653.tmp
  • %TEMP%\tmp263f.tmp
  • %TEMP%\tmp262e.tmp
  • %TEMP%\tmp261c.tmp
  • %TEMP%\tmp260b.tmp
  • %TEMP%\tmp2609.tmp
  • %TEMP%\tmp25f7.tmp
  • %TEMP%\tmp25e5.tmp
  • %TEMP%\tmp25d4.tmp
  • %TEMP%\tmp25d2.tmp
  • %TEMP%\tmp25c0.tmp
  • %TEMP%\tmp2641.tmp
  • %TEMP%\tmp25be.tmp
  • %TEMP%\tmp259d.tmp
  • %TEMP%\tmp26fb.tmp
  • %TEMP%\tmp26e8.tmp
  • %TEMP%\tmp27ee.tmp
  • %TEMP%\tmp27ed.tmp
  • %TEMP%\tmp27dd.tmp
  • %TEMP%\tmp27db.tmp
  • %TEMP%\tmp27c9.tmp
  • %TEMP%\tmp27b7.tmp
  • %TEMP%\tmp27b5.tmp
  • %TEMP%\tmp27a4.tmp
  • %TEMP%\tmp2792.tmp
  • %TEMP%\tmp26ea.tmp
  • %TEMP%\tmp2790.tmp
  • %TEMP%\tmp26d6.tmp
  • %TEMP%\tmp276b.tmp
  • %TEMP%\tmp2769.tmp
  • %TEMP%\tmp2757.tmp
  • %TEMP%\tmp2746.tmp
  • %TEMP%\tmp2744.tmp
  • %TEMP%\tmp2732.tmp
  • %TEMP%\tmp2711.tmp
  • %TEMP%\tmp270f.tmp
  • %TEMP%\tmp26fd.tmp
  • %TEMP%\tmp277f.tmp
  • %TEMP%\tmpe7e.tmp
  • %TEMP%\tmp277d.tmp
  • %TEMP%\tmp101f.tmp
  • %TEMP%\tmpf96.tmp
  • %TEMP%\tmpf94.tmp
  • %TEMP%\tmpf63.tmp
  • %TEMP%\tmpf61.tmp
  • %TEMP%\tmpf50.tmp
  • %TEMP%\tmpf4e.tmp
  • %TEMP%\tmpf3c.tmp
  • %TEMP%\tmpf3a.tmp
  • %TEMP%\tmpf29.tmp
  • %TEMP%\tmpf27.tmp
  • %TEMP%\tmp10a2.tmp
  • %TEMP%\tmpf15.tmp
  • %TEMP%\tmpf01.tmp
  • %TEMP%\tmpef0.tmp
  • %TEMP%\tmpeee.tmp
  • %TEMP%\tmpedc.tmp
  • %TEMP%\tmpeda.tmp
  • %TEMP%\tmpec9.tmp
  • %TEMP%\tmpeb7.tmp
  • %TEMP%\tmpea5.tmp
  • %TEMP%\tmpea3.tmp
  • %TEMP%\tmpe92.tmp
  • %TEMP%\tmpf03.tmp
  • %TEMP%\tmp259b.tmp
  • %TEMP%\tmp10b2.tmp
  • %TEMP%\tmpfbd.tmp
  • %TEMP%\tmpfaa.tmp
  • %TEMP%\tmp1091.tmp
  • %TEMP%\tmp1090.tmp
  • %TEMP%\tmp107f.tmp
  • %TEMP%\tmp107d.tmp
  • %TEMP%\tmp105c.tmp
  • %TEMP%\tmp105a.tmp
  • %TEMP%\tmp1049.tmp
  • %TEMP%\tmp1047.tmp
  • %TEMP%\tmp1035.tmp
  • %TEMP%\tmpfbb.tmp
  • %TEMP%\tmp1033.tmp
  • %TEMP%\tmpfa8.tmp
  • %TEMP%\tmp100e.tmp
  • %TEMP%\tmp100c.tmp
  • %TEMP%\tmp100a.tmp
  • %TEMP%\tmpff8.tmp
  • %TEMP%\tmpff6.tmp
  • %TEMP%\tmpfe5.tmp
  • %TEMP%\tmpfe3.tmp
  • %TEMP%\tmpfd1.tmp
  • %TEMP%\tmpfcf.tmp
  • %TEMP%\tmp1021.tmp
  • %TEMP%\tmpe90.tmp
  • %TEMP%\tmp281f.tmp
  • %TEMP%\tmp4441.tmp
  • %TEMP%\tmp5c33.tmp
  • %TEMP%\tmp5c21.tmp
  • %TEMP%\tmp5c10.tmp
  • %TEMP%\tmp5c0e.tmp
  • %TEMP%\tmp5bed.tmp
  • %TEMP%\tmp5bdb.tmp
  • %TEMP%\tmp5bd9.tmp
  • %TEMP%\tmp5bc7.tmp
  • %TEMP%\tmp5bb6.tmp
  • %TEMP%\tmp5bb4.tmp
  • %TEMP%\tmp5b0b.tmp
  • %TEMP%\tmp5ba2.tmp
  • %TEMP%\tmp5b8f.tmp
  • %TEMP%\tmp5b8d.tmp
  • %TEMP%\tmp5b7b.tmp
  • %TEMP%\tmp5b69.tmp
  • %TEMP%\tmp5b67.tmp
  • %TEMP%\tmp5b56.tmp
  • %TEMP%\tmp5b44.tmp
  • %TEMP%\tmp5b42.tmp
  • %TEMP%\tmp5b31.tmp
  • %TEMP%\tmp5b2f.tmp
  • %TEMP%\tmp5ba0.tmp
  • %TEMP%\tmp5b1d.tmp
  • %TEMP%\tmp5c35.tmp
  • %TEMP%\tmp5cad.tmp
  • %TEMP%\tmp5d0f.tmp
  • %TEMP%\tmp5cfe.tmp
  • %TEMP%\tmp5cfd.tmp
  • %TEMP%\tmp5cfb.tmp
  • %TEMP%\tmp5ce9.tmp
  • %TEMP%\tmp5ce7.tmp
  • %TEMP%\tmp5cd6.tmp
  • %TEMP%\tmp5cd4.tmp
  • %TEMP%\tmp5cc2.tmp
  • %TEMP%\tmp5cc0.tmp
  • %TEMP%\tmp5c49.tmp
  • %TEMP%\tmp5c37.tmp
  • %TEMP%\tmp5c9b.tmp
  • %TEMP%\tmp5c99.tmp
  • %TEMP%\tmp5c97.tmp
  • %TEMP%\tmp5c85.tmp
  • %TEMP%\tmp5c74.tmp
  • %TEMP%\tmp5c72.tmp
  • %TEMP%\tmp5c70.tmp
  • %TEMP%\tmp5c5e.tmp
  • %TEMP%\tmp5c5c.tmp
  • %TEMP%\tmp5c4b.tmp
  • %TEMP%\tmp5caf.tmp
  • %TEMP%\tmp43be.tmp
  • %TEMP%\tmp43ac.tmp
  • %TEMP%\tmp45e1.tmp
  • %TEMP%\tmp4443.tmp
  • %TEMP%\tmp44b3.tmp
  • %TEMP%\tmp44a1.tmp
  • %TEMP%\tmp449f.tmp
  • %TEMP%\tmp448d.tmp
  • %TEMP%\tmp448b.tmp
  • %TEMP%\tmp446a.tmp
  • %TEMP%\tmp4468.tmp
  • %TEMP%\tmp4457.tmp
  • %TEMP%\tmp4455.tmp
  • %TEMP%\tmp44e3.tmp
  • %TEMP%\tmp44e5.tmp
  • %TEMP%\tmp45e2.tmp
  • %TEMP%\tmp442d.tmp
  • %TEMP%\tmp441c.tmp
  • %TEMP%\tmp440a.tmp
  • %TEMP%\tmp43f9.tmp
  • %TEMP%\tmp43f7.tmp
  • %TEMP%\tmp43e5.tmp
  • %TEMP%\tmp43d3.tmp
  • %TEMP%\tmp43d1.tmp
  • %TEMP%\tmp43c0.tmp
  • %TEMP%\tmp442f.tmp
  • %TEMP%\tmp5b09.tmp
  • %TEMP%\tmp44f7.tmp
  • %TEMP%\tmp455f.tmp
  • %TEMP%\tmp4571.tmp
  • %TEMP%\tmp45c0.tmp
  • %TEMP%\tmp45bf.tmp
  • %TEMP%\tmp45ad.tmp
  • %TEMP%\tmp45ab.tmp
  • %TEMP%\tmp459a.tmp
  • %TEMP%\tmp4598.tmp
  • %TEMP%\tmp4586.tmp
  • %TEMP%\tmp4584.tmp
  • %TEMP%\tmp4573.tmp
  • %TEMP%\tmp45c1.tmp
  • %TEMP%\tmp44f9.tmp
  • %TEMP%\tmp44fb.tmp
  • %TEMP%\tmp454b.tmp
  • %TEMP%\tmp4549.tmp
  • %TEMP%\tmp4547.tmp
  • %TEMP%\tmp4536.tmp
  • %TEMP%\tmp4534.tmp
  • %TEMP%\tmp4522.tmp
  • %TEMP%\tmp4520.tmp
  • %TEMP%\tmp450f.tmp
  • %TEMP%\tmp450d.tmp
  • %TEMP%\tmp455d.tmp
  • %TEMP%\tmpe7c.tmp
  • %TEMP%\tmpf6f4.tmp
  • %TEMP%\tmpf6e4.tmp
  • %TEMP%\tmpc582.tmp
  • %TEMP%\tmpc580.tmp
  • %TEMP%\tmpc56f.tmp
  • %TEMP%\tmpc56d.tmp
  • %TEMP%\tmpc55b.tmp
  • %TEMP%\tmpc54a.tmp
  • %TEMP%\tmpc548.tmp
  • %TEMP%\tmpc536.tmp
  • %TEMP%\tmpc524.tmp
  • %TEMP%\tmpc5b5.tmp
  • %TEMP%\tmpc513.tmp
  • %TEMP%\tmpc4f0.tmp
  • %TEMP%\tmpc4de.tmp
  • %TEMP%\tmpc4dc.tmp
  • %TEMP%\tmpc4bb.tmp
  • %TEMP%\tmpc4b9.tmp
  • %TEMP%\tmpc4a7.tmp
  • %TEMP%\tmpc496.tmp
  • %TEMP%\tmpc494.tmp
  • %TEMP%\tmpc482.tmp
  • %TEMP%\tmpc480.tmp
  • %TEMP%\tmpc501.tmp
  • %TEMP%\tmpc46e.tmp
  • %TEMP%\tmpc6b2.tmp
  • %TEMP%\tmpabbe.tmp
  • %TEMP%\tmpc6b1.tmp
  • %TEMP%\tmpc6b0.tmp
  • %TEMP%\tmpc69e.tmp
  • %TEMP%\tmpc68d.tmp
  • %TEMP%\tmpc68b.tmp
  • %TEMP%\tmpc679.tmp
  • %TEMP%\tmpc677.tmp
  • %TEMP%\tmpc666.tmp
  • %TEMP%\tmpc664.tmp
  • %TEMP%\tmpc652.tmp
  • %TEMP%\tmpc5c9.tmp
  • %TEMP%\tmpc5c7.tmp
  • %TEMP%\tmpc63c.tmp
  • %TEMP%\tmpc62b.tmp
  • %TEMP%\tmpc629.tmp
  • %TEMP%\tmpc617.tmp
  • %TEMP%\tmpc615.tmp
  • %TEMP%\tmpc604.tmp
  • %TEMP%\tmpc602.tmp
  • %TEMP%\tmpc5f0.tmp
  • %TEMP%\tmpc5ee.tmp
  • %TEMP%\tmpc5dc.tmp
  • %TEMP%\tmpc63e.tmp
  • %TEMP%\tmpc5cb.tmp
  • %TEMP%\tmpc640.tmp
  • %TEMP%\tmpab9d.tmp
  • %TEMP%\tmpab2c.tmp
  • %TEMP%\tmpaa7d.tmp
  • %TEMP%\tmpaa7b.tmp
  • %TEMP%\tmpaa6a.tmp
  • %TEMP%\tmpaa58.tmp
  • %TEMP%\tmpaa46.tmp
  • %TEMP%\tmpaa44.tmp
  • %TEMP%\tmpaa33.tmp
  • %TEMP%\tmpaa31.tmp
  • %TEMP%\tmpaa1f.tmp
  • %TEMP%\tmpaa91.tmp
  • %TEMP%\tmpaa1d.tmp
  • %TEMP%\tmpa9fa.tmp
  • %TEMP%\tmpa9f8.tmp
  • %TEMP%\tmpa9e6.tmp
  • %TEMP%\tmpa9c5.tmp
  • %TEMP%\tmpa9b4.tmp
  • %TEMP%\tmpa9a2.tmp
  • %TEMP%\tmpa990.tmp
  • %TEMP%\tmpa97f.tmp
  • %TEMP%\tmpa96d.tmp
  • %TEMP%\tmpa96b.tmp
  • %TEMP%\tmpaa0c.tmp
  • %TEMP%\tmpabbd.tmp
  • %TEMP%\tmpc6d2.tmp
  • %TEMP%\tmpaa8f.tmp
  • %TEMP%\tmpab8d.tmp
  • %TEMP%\tmpab7c.tmp
  • %TEMP%\tmpab7a.tmp
  • %TEMP%\tmpab68.tmp
  • %TEMP%\tmpab66.tmp
  • %TEMP%\tmpab55.tmp
  • %TEMP%\tmpab53.tmp
  • %TEMP%\tmpab41.tmp
  • %TEMP%\tmpab3f.tmp
  • %TEMP%\tmpab2e.tmp
  • %TEMP%\tmpaab4.tmp
  • %TEMP%\tmpaaa2.tmp
  • %TEMP%\tmpab18.tmp
  • %TEMP%\tmpab16.tmp
  • %TEMP%\tmpab04.tmp
  • %TEMP%\tmpab02.tmp
  • %TEMP%\tmpaaf1.tmp
  • %TEMP%\tmpaaef.tmp
  • %TEMP%\tmpaadd.tmp
  • %TEMP%\tmpaadb.tmp
  • %TEMP%\tmpaaca.tmp
  • %TEMP%\tmpaac8.tmp
  • %TEMP%\tmpab1a.tmp
  • %TEMP%\tmpaab6.tmp
  • %TEMP%\tmpc594.tmp
  • %TEMP%\tmpc6d3.tmp
  • %TEMP%\tmpf5a8.tmp
  • %TEMP%\tmpf536.tmp
  • %TEMP%\tmpf5a6.tmp
  • %TEMP%\tmpf594.tmp
  • %TEMP%\tmpf592.tmp
  • %TEMP%\tmpf580.tmp
  • %TEMP%\tmpf56f.tmp
  • %TEMP%\tmpf56d.tmp
  • %TEMP%\tmpf55b.tmp
  • %TEMP%\tmpf559.tmp
  • %TEMP%\tmpf548.tmp
  • %TEMP%\tmpdfa7.tmp
  • %TEMP%\tmpf5b9.tmp
  • %TEMP%\tmpf4b1.tmp
  • %TEMP%\tmpf511.tmp
  • %TEMP%\tmpf4ff.tmp
  • %TEMP%\tmpf4fd.tmp
  • %TEMP%\tmpf4ec.tmp
  • %TEMP%\tmpf4ea.tmp
  • %TEMP%\tmpf4d8.tmp
  • %TEMP%\tmpf4c6.tmp
  • %TEMP%\tmpf4c4.tmp
  • %TEMP%\tmpf4b3.tmp
  • %TEMP%\tmpf522.tmp
  • %TEMP%\tmpf524.tmp
  • %TEMP%\tmpf5bb.tmp
  • %TEMP%\tmpf642.tmp
  • %TEMP%\tmpf654.tmp
  • %TEMP%\tmpf6c3.tmp
  • %TEMP%\tmpf6c2.tmp
  • %TEMP%\tmpf6b0.tmp
  • %TEMP%\tmpf6ae.tmp
  • %TEMP%\tmpf69c.tmp
  • %TEMP%\tmpf68b.tmp
  • %TEMP%\tmpf679.tmp
  • %TEMP%\tmpf677.tmp
  • %TEMP%\tmpf666.tmp
  • %TEMP%\tmpf6d3.tmp
  • %TEMP%\tmpf5cd.tmp
  • %TEMP%\tmpf5cf.tmp
  • %TEMP%\tmpf62f.tmp
  • %TEMP%\tmpf62d.tmp
  • %TEMP%\tmpf61b.tmp
  • %TEMP%\tmpf619.tmp
  • %TEMP%\tmpf608.tmp
  • %TEMP%\tmpf5f6.tmp
  • %TEMP%\tmpf5f4.tmp
  • %TEMP%\tmpf5e2.tmp
  • %TEMP%\tmpf5e0.tmp
  • %TEMP%\tmpf640.tmp
  • %TEMP%\tmpf49f.tmp
  • %TEMP%\tmpdf96.tmp
  • %TEMP%\tmpdd71.tmp
  • %TEMP%\tmpde75.tmp
  • %TEMP%\tmpde64.tmp
  • %TEMP%\tmpde62.tmp
  • %TEMP%\tmpde50.tmp
  • %TEMP%\tmpde4e.tmp
  • %TEMP%\tmpde3c.tmp
  • %TEMP%\tmpde1b.tmp
  • %TEMP%\tmpde19.tmp
  • %TEMP%\tmpde08.tmp
  • %TEMP%\tmpde89.tmp
  • %TEMP%\tmpddf6.tmp
  • %TEMP%\tmpdde2.tmp
  • %TEMP%\tmpddd1.tmp
  • %TEMP%\tmpddbf.tmp
  • %TEMP%\tmpddbd.tmp
  • %TEMP%\tmpddac.tmp
  • %TEMP%\tmpddaa.tmp
  • %TEMP%\tmpdd98.tmp
  • %TEMP%\tmpdd86.tmp
  • %TEMP%\tmpdd84.tmp
  • %TEMP%\tmpdd73.tmp
  • %TEMP%\tmpdde4.tmp
  • %TEMP%\tmpde9a.tmp
  • %TEMP%\tmpde87.tmp
  • %TEMP%\tmpde9c.tmp
  • %TEMP%\tmpdf86.tmp
  • %TEMP%\tmpdf24.tmp
  • %TEMP%\tmpdf75.tmp
  • %TEMP%\tmpdf74.tmp
  • %TEMP%\tmpdf72.tmp
  • %TEMP%\tmpdf60.tmp
  • %TEMP%\tmpdf5e.tmp
  • %TEMP%\tmpdf4d.tmp
  • %TEMP%\tmpdf4b.tmp
  • %TEMP%\tmpdf39.tmp
  • %TEMP%\tmpdf37.tmp
  • %TEMP%\tmpdf26.tmp
  • %TEMP%\tmpdf22.tmp
  • %TEMP%\tmpdeae.tmp
  • %TEMP%\tmpdf10.tmp
  • %TEMP%\tmpdefe.tmp
  • %TEMP%\tmpdeed.tmp
  • %TEMP%\tmpdeeb.tmp
  • %TEMP%\tmpded9.tmp
  • %TEMP%\tmpded7.tmp
  • %TEMP%\tmpdec6.tmp
  • %TEMP%\tmpdec4.tmp
  • %TEMP%\tmpdec2.tmp
  • %TEMP%\tmpdeb0.tmp
  • %TEMP%\tmp5d1f.tmp
  • %TEMP%\tmp5d30.tmp
Network activity
Connects to
  • '18#.#0.185.124':35253
TCP
HTTP GET requests
  • http://ch#####.amazonaws.com/
  • http://www.ge###ugin.net/json.gp?ip###############
  • 'ap#.ip.sb':443
  • 'wh###.iana.org':43
  • 'WH###.RIPE.NET':43
  • UDP
    • DNS ASK ap#.ip.sb
    • DNS ASK ch#####.amazonaws.com
    • DNS ASK wh###.iana.org
    • DNS ASK WH###.RIPE.NET
    • DNS ASK ge###ugin.net

    Curing recommendations

    1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
    2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
    Download Dr.Web

    Download by serial number

    Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

    After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

    Download Dr.Web

    Download by serial number

    1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
    2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
      • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
      • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
      • Switch off your device and turn it on as normal.

    Find out more about Dr.Web for Android

    The Russian developer of Dr.Web anti-viruses
    Doctor Web has been developing anti-virus software since 1992
    Dr.Web is trusted by users around the world in 200+ countries
    The company has delivered an anti-virus as a service since 2007
    24/7 tech support

    Dr.Web © Doctor Web
    2003 — 2021

    Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

    2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124