Trojan.DownLoader35.6963

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im geckodriver.exe /T

Modifies file system

Creates the following files

%HOMEPATH%\20201021_gtool_newtab.exe
%TEMP%\_mei25962\pytz\zoneinfo\canada\pacific
%TEMP%\_mei25962\pytz\zoneinfo\canada\saskatchewan
%TEMP%\_mei25962\pytz\zoneinfo\canada\yukon
%TEMP%\_mei25962\pytz\zoneinfo\chile\continental
%TEMP%\_mei25962\pytz\zoneinfo\chile\easterisland
%TEMP%\_mei25962\pytz\zoneinfo\cuba
%TEMP%\_mei25962\pytz\zoneinfo\australia\tasmania
%TEMP%\_mei25962\pytz\zoneinfo\eet
%TEMP%\_mei25962\pytz\zoneinfo\est5edt
%TEMP%\_mei25962\pytz\zoneinfo\egypt
%TEMP%\_mei25962\pytz\zoneinfo\eire
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+0
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+1
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+10
%TEMP%\_mei25962\pytz\zoneinfo\canada\eastern
%TEMP%\_mei25962\pytz\zoneinfo\est
%TEMP%\_mei25962\pytz\zoneinfo\canada\newfoundland
%TEMP%\_mei25962\pytz\zoneinfo\canada\mountain
%TEMP%\_mei25962\pytz\zoneinfo\canada\central
%TEMP%\_mei25962\pytz\zoneinfo\canada\atlantic
%TEMP%\_mei25962\pytz\zoneinfo\australia\melbourne
%TEMP%\_mei25962\pytz\zoneinfo\australia\nsw
%TEMP%\_mei25962\pytz\zoneinfo\australia\north
%TEMP%\_mei25962\pytz\zoneinfo\australia\perth
%TEMP%\_mei25962\pytz\zoneinfo\australia\queensland
%TEMP%\_mei25962\pytz\zoneinfo\australia\south
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+11
%TEMP%\_mei25962\pytz\zoneinfo\australia\sydney
%TEMP%\_mei25962\pytz\zoneinfo\australia\lhi
%TEMP%\_mei25962\pytz\zoneinfo\australia\victoria
%TEMP%\_mei25962\pytz\zoneinfo\australia\yancowinna
%TEMP%\_mei25962\pytz\zoneinfo\brazil\acre
%TEMP%\_mei25962\pytz\zoneinfo\brazil\denoronha
%TEMP%\_mei25962\pytz\zoneinfo\brazil\east
%TEMP%\_mei25962\pytz\zoneinfo\brazil\west
%TEMP%\_mei25962\pytz\zoneinfo\cet
%TEMP%\_mei25962\pytz\zoneinfo\australia\lindeman
%TEMP%\_mei25962\pytz\zoneinfo\cst6cdt
%TEMP%\_mei25962\pytz\zoneinfo\australia\west
%TEMP%\_mei25962\pytz\zoneinfo\australia\lord_howe
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+12
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+5
%TEMP%\_mei25962\pytz\zoneinfo\etc\uct
%TEMP%\_mei25962\pytz\zoneinfo\etc\utc
%TEMP%\_mei25962\pytz\zoneinfo\etc\universal
%TEMP%\_mei25962\pytz\zoneinfo\etc\zulu
%TEMP%\_mei25962\pytz\zoneinfo\europe\amsterdam
%TEMP%\_mei25962\pytz\zoneinfo\europe\andorra
%TEMP%\_mei25962\pytz\zoneinfo\europe\astrakhan
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-8
%TEMP%\_mei25962\pytz\zoneinfo\europe\athens
%TEMP%\_mei25962\pytz\zoneinfo\europe\belgrade
%TEMP%\_mei25962\pytz\zoneinfo\europe\berlin
%TEMP%\_mei25962\pytz\zoneinfo\europe\bratislava
%TEMP%\_mei25962\pytz\zoneinfo\europe\brussels
%TEMP%\_mei25962\pytz\zoneinfo\europe\bucharest
%TEMP%\_mei25962\pytz\zoneinfo\europe\budapest
%TEMP%\_mei25962\pytz\zoneinfo\europe\busingen
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt0
%TEMP%\_mei25962\pytz\zoneinfo\etc\greenwich
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-9
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-7
%TEMP%\_mei25962\pytz\zoneinfo\asia\tokyo
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+6
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+7
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+8
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+9
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-0
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-1
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+2
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+4
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt+3
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-10
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-14
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-2
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-3
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-4
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-5
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-6
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-11
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-12
%TEMP%\_mei25962\pytz\zoneinfo\etc\gmt-13
%TEMP%\_mei25962\pytz\zoneinfo\australia\hobart
%TEMP%\_mei25962\pytz\zoneinfo\australia\eucla
%TEMP%\_mei25962\pytz\zoneinfo\australia\darwin
%TEMP%\_mei25962\pytz\zoneinfo\asia\muscat
%TEMP%\_mei25962\pytz\zoneinfo\asia\nicosia
%TEMP%\_mei25962\pytz\zoneinfo\asia\novokuznetsk
%TEMP%\_mei25962\pytz\zoneinfo\asia\novosibirsk
%TEMP%\_mei25962\pytz\zoneinfo\asia\omsk
%TEMP%\_mei25962\pytz\zoneinfo\asia\oral
%TEMP%\_mei25962\pytz\zoneinfo\asia\phnom_penh
%TEMP%\_mei25962\pytz\zoneinfo\asia\samarkand
%TEMP%\_mei25962\pytz\zoneinfo\asia\pontianak
%TEMP%\_mei25962\pytz\zoneinfo\asia\qatar
%TEMP%\_mei25962\pytz\zoneinfo\asia\qostanay
%TEMP%\_mei25962\pytz\zoneinfo\asia\qyzylorda
%TEMP%\_mei25962\pytz\zoneinfo\asia\rangoon
%TEMP%\_mei25962\pytz\zoneinfo\asia\riyadh
%TEMP%\_mei25962\pytz\zoneinfo\asia\saigon
%TEMP%\_mei25962\pytz\zoneinfo\asia\magadan
%TEMP%\_mei25962\pytz\zoneinfo\asia\macau
%TEMP%\_mei25962\pytz\zoneinfo\asia\manila
%TEMP%\_mei25962\pytz\zoneinfo\asia\macao
%TEMP%\_mei25962\pytz\zoneinfo\asia\kuwait
%TEMP%\_mei25962\pytz\zoneinfo\asia\hong_kong
%TEMP%\_mei25962\pytz\zoneinfo\asia\irkutsk
%TEMP%\_mei25962\pytz\zoneinfo\asia\istanbul
%TEMP%\_mei25962\pytz\zoneinfo\asia\jakarta
%TEMP%\_mei25962\pytz\zoneinfo\asia\jayapura
%TEMP%\_mei25962\pytz\zoneinfo\asia\jerusalem
%TEMP%\_mei25962\pytz\zoneinfo\asia\kabul
%TEMP%\_mei25962\pytz\zoneinfo\asia\sakhalin
%TEMP%\_mei25962\pytz\zoneinfo\asia\kamchatka
%TEMP%\_mei25962\pytz\zoneinfo\asia\pyongyang
%TEMP%\_mei25962\pytz\zoneinfo\asia\kashgar
%TEMP%\_mei25962\pytz\zoneinfo\asia\katmandu
%TEMP%\_mei25962\pytz\zoneinfo\asia\khandyga
%TEMP%\_mei25962\pytz\zoneinfo\asia\kolkata
%TEMP%\_mei25962\pytz\zoneinfo\asia\krasnoyarsk
%TEMP%\_mei25962\pytz\zoneinfo\asia\kuala_lumpur
%TEMP%\_mei25962\pytz\zoneinfo\asia\kuching
%TEMP%\_mei25962\pytz\zoneinfo\asia\karachi
%TEMP%\_mei25962\pytz\zoneinfo\asia\hovd
%TEMP%\_mei25962\pytz\zoneinfo\asia\kathmandu
%TEMP%\_mei25962\pytz\zoneinfo\asia\makassar
%TEMP%\_mei25962\pytz\zoneinfo\asia\seoul
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\azores
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\canary
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\cape_verde
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\faeroe
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\faroe
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\jan_mayen
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\madeira
%TEMP%\_mei25962\pytz\zoneinfo\asia\yerevan
%TEMP%\_mei25962\pytz\zoneinfo\asia\shanghai
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\bermuda
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\reykjavik
%TEMP%\_mei25962\pytz\zoneinfo\australia\act
%TEMP%\_mei25962\pytz\zoneinfo\australia\adelaide
%TEMP%\_mei25962\pytz\zoneinfo\australia\brisbane
%TEMP%\_mei25962\pytz\zoneinfo\australia\broken_hill
%TEMP%\_mei25962\pytz\zoneinfo\australia\canberra
%TEMP%\_mei25962\pytz\zoneinfo\australia\currie
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\south_georgia
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\st_helena
%TEMP%\_mei25962\pytz\zoneinfo\atlantic\stanley
%TEMP%\_mei25962\pytz\zoneinfo\europe\belfast
%TEMP%\_mei25962\pytz\zoneinfo\europe\chisinau
%TEMP%\_mei25962\pytz\zoneinfo\asia\yakutsk
%TEMP%\_mei25962\pytz\zoneinfo\asia\srednekolymsk
%TEMP%\_mei25962\pytz\zoneinfo\asia\taipei
%TEMP%\_mei25962\pytz\zoneinfo\asia\tashkent
%TEMP%\_mei25962\pytz\zoneinfo\asia\tbilisi
%TEMP%\_mei25962\pytz\zoneinfo\asia\tehran
%TEMP%\_mei25962\pytz\zoneinfo\asia\tel_aviv
%TEMP%\_mei25962\pytz\zoneinfo\asia\thimbu
%TEMP%\_mei25962\pytz\zoneinfo\asia\yangon
%TEMP%\_mei25962\pytz\zoneinfo\asia\yekaterinburg
%TEMP%\_mei25962\pytz\zoneinfo\asia\thimphu
%TEMP%\_mei25962\pytz\zoneinfo\asia\ujung_pandang
%TEMP%\_mei25962\pytz\zoneinfo\asia\ulaanbaatar
%TEMP%\_mei25962\pytz\zoneinfo\asia\ulan_bator
%TEMP%\_mei25962\pytz\zoneinfo\asia\urumqi
%TEMP%\_mei25962\pytz\zoneinfo\asia\ust-nera
%TEMP%\_mei25962\pytz\zoneinfo\asia\vientiane
%TEMP%\_mei25962\pytz\zoneinfo\asia\vladivostok
%TEMP%\_mei25962\pytz\zoneinfo\asia\singapore
%TEMP%\_mei25962\pytz\zoneinfo\asia\tomsk
%TEMP%\_mei25962\pytz\zoneinfo\europe\copenhagen
%TEMP%\_mei25962\pytz\zoneinfo\europe\dublin
%TEMP%\_mei25962\pytz\zoneinfo\europe\gibraltar
%TEMP%\_mei25962\pytz\zoneinfo\pacific\niue
%TEMP%\_mei25962\pytz\zoneinfo\pacific\norfolk
%TEMP%\_mei25962\pytz\zoneinfo\pacific\noumea
%TEMP%\_mei25962\pytz\zoneinfo\pacific\pago_pago
%TEMP%\_mei25962\pytz\zoneinfo\pacific\palau
%TEMP%\_mei25962\pytz\zoneinfo\pacific\pitcairn
%TEMP%\_mei25962\pytz\zoneinfo\pacific\pohnpei
%TEMP%\_mei25962\pytz\zoneinfo\pacific\funafuti
%TEMP%\_mei25962\pytz\zoneinfo\pacific\ponape
%TEMP%\_mei25962\pytz\zoneinfo\pacific\rarotonga
%TEMP%\_mei25962\pytz\zoneinfo\pacific\saipan
%TEMP%\_mei25962\pytz\zoneinfo\pacific\samoa
%TEMP%\_mei25962\pytz\zoneinfo\pacific\tahiti
%TEMP%\_mei25962\pytz\zoneinfo\pacific\tarawa
%TEMP%\_mei25962\pytz\zoneinfo\pacific\tongatapu
%TEMP%\_mei25962\pytz\zoneinfo\pacific\truk
%TEMP%\_mei25962\pytz\zoneinfo\pacific\midway
%TEMP%\_mei25962\pytz\zoneinfo\pacific\nauru
%TEMP%\_mei25962\pytz\zoneinfo\pacific\marquesas
%TEMP%\_mei25962\pytz\zoneinfo\pacific\majuro
%TEMP%\_mei25962\pytz\zoneinfo\pacific\kwajalein
%TEMP%\_mei25962\pytz\zoneinfo\pacific\bougainville
%TEMP%\_mei25962\pytz\zoneinfo\pacific\chatham
%TEMP%\_mei25962\pytz\zoneinfo\pacific\chuuk
%TEMP%\_mei25962\pytz\zoneinfo\pacific\easter
%TEMP%\_mei25962\pytz\zoneinfo\pacific\efate
%TEMP%\_mei25962\pytz\zoneinfo\pacific\enderbury
%TEMP%\_mei25962\pytz\zoneinfo\pacific\fakaofo
%TEMP%\_mei25962\pytz\zoneinfo\pacific\wake
%TEMP%\_mei25962\pytz\zoneinfo\pacific\port_moresby
%TEMP%\_mei25962\pytz\zoneinfo\pacific\fiji
%TEMP%\_mei25962\pytz\zoneinfo\pacific\gambier
%TEMP%\_mei25962\pytz\zoneinfo\pacific\guadalcanal
%TEMP%\_mei25962\pytz\zoneinfo\pacific\guam
%TEMP%\_mei25962\pytz\zoneinfo\pacific\honolulu
%TEMP%\_mei25962\pytz\zoneinfo\pacific\johnston
%TEMP%\_mei25962\pytz\zoneinfo\pacific\kiritimati
%TEMP%\_mei25962\pytz\zoneinfo\pacific\kosrae
%TEMP%\_mei25962\pytz\zoneinfo\pacific\auckland
%TEMP%\_mei25962\pytz\zoneinfo\pacific\galapagos
%TEMP%\_mei25962\pytz\zoneinfo\pacific\wallis
%TEMP%\_mei25962\pytz\zoneinfo\pacific\yap
%TEMP%\_mei25962\pytz\zoneinfo\poland
%TEMP%\_mei25962\pytz\zoneinfo\zulu
%TEMP%\_mei25962\pytz\zoneinfo\iso3166.tab
%TEMP%\_mei25962\pytz\zoneinfo\leapseconds
%TEMP%\_mei25962\pytz\zoneinfo\posixrules
%TEMP%\_mei25962\pytz\zoneinfo\tzdata.zi
%TEMP%\_mei25962\pytz\zoneinfo\zone.tab
%TEMP%\_mei25962\pytz\zoneinfo\zone1970.tab
%TEMP%\_mei25962\selenium\webdriver\firefox\amd64\x_ignore_nofocus.so
%TEMP%\_mei25962\selenium\webdriver\firefox\webdriver_prefs.json
%TEMP%\_mei25962\pytz\zoneinfo\pacific\apia
%TEMP%\_mei25962\selenium\webdriver\firefox\x86\x_ignore_nofocus.so
%TEMP%\_mei25962\selenium\webdriver\remote\getattribute.js
%TEMP%\_mei25962\selenium\webdriver\remote\isdisplayed.js
%TEMP%\va99becm
<Current directory>\geckodriver-v0.27.0-win64.zip
<Current directory>\geckodriver.exe
%TEMP%\tmp67_s5f91\user.js
%TEMP%\tmphn75r_4p\user.js
%TEMP%\_mei25962\pytz\zoneinfo\wet
%TEMP%\_mei25962\pytz\zoneinfo\us\central
%TEMP%\_mei25962\pytz\zoneinfo\w-su
%TEMP%\_mei25962\pytz\zoneinfo\us\arizona
%TEMP%\_mei25962\pytz\zoneinfo\portugal
%TEMP%\_mei25962\pytz\zoneinfo\roc
%TEMP%\_mei25962\pytz\zoneinfo\rok
%TEMP%\_mei25962\pytz\zoneinfo\singapore
%TEMP%\_mei25962\pytz\zoneinfo\turkey
%TEMP%\_mei25962\pytz\zoneinfo\uct
%TEMP%\_mei25962\pytz\zoneinfo\us\alaska
%TEMP%\_mei25962\pytz\zoneinfo\us\aleutian
%TEMP%\_mei25962\pytz\zoneinfo\asia\ho_chi_minh
%TEMP%\_mei25962\pytz\zoneinfo\utc
%TEMP%\_mei25962\pytz\zoneinfo\us\east-indiana
%TEMP%\_mei25962\pytz\zoneinfo\us\eastern
%TEMP%\_mei25962\pytz\zoneinfo\us\hawaii
%TEMP%\_mei25962\pytz\zoneinfo\us\indiana-starke
%TEMP%\_mei25962\pytz\zoneinfo\us\michigan
%TEMP%\_mei25962\pytz\zoneinfo\us\mountain
%TEMP%\_mei25962\pytz\zoneinfo\us\pacific
%TEMP%\_mei25962\pytz\zoneinfo\us\samoa
%TEMP%\_mei25962\pytz\zoneinfo\universal
%TEMP%\_mei25962\pytz\zoneinfo\gmt-0
%TEMP%\_mei25962\pytz\zoneinfo\pst8pdt
%TEMP%\_mei25962\pytz\zoneinfo\kwajalein
%TEMP%\_mei25962\pytz\zoneinfo\europe\riga
%TEMP%\_mei25962\pytz\zoneinfo\europe\rome
%TEMP%\_mei25962\pytz\zoneinfo\europe\samara
%TEMP%\_mei25962\pytz\zoneinfo\europe\san_marino
%TEMP%\_mei25962\pytz\zoneinfo\europe\sarajevo
%TEMP%\_mei25962\pytz\zoneinfo\europe\saratov
%TEMP%\_mei25962\pytz\zoneinfo\europe\simferopol
%TEMP%\_mei25962\pytz\zoneinfo\europe\ljubljana
%TEMP%\_mei25962\pytz\zoneinfo\europe\skopje
%TEMP%\_mei25962\pytz\zoneinfo\europe\stockholm
%TEMP%\_mei25962\pytz\zoneinfo\europe\tallinn
%TEMP%\_mei25962\pytz\zoneinfo\europe\tirane
%TEMP%\_mei25962\pytz\zoneinfo\europe\tiraspol
%TEMP%\_mei25962\pytz\zoneinfo\europe\ulyanovsk
%TEMP%\_mei25962\pytz\zoneinfo\europe\uzhgorod
%TEMP%\_mei25962\pytz\zoneinfo\europe\vaduz
%TEMP%\_mei25962\pytz\zoneinfo\europe\podgorica
%TEMP%\_mei25962\pytz\zoneinfo\europe\prague
%TEMP%\_mei25962\pytz\zoneinfo\europe\paris
%TEMP%\_mei25962\pytz\zoneinfo\europe\oslo
%TEMP%\_mei25962\pytz\zoneinfo\europe\nicosia
%TEMP%\_mei25962\pytz\zoneinfo\europe\helsinki
%TEMP%\_mei25962\pytz\zoneinfo\europe\isle_of_man
%TEMP%\_mei25962\pytz\zoneinfo\europe\istanbul
%TEMP%\_mei25962\pytz\zoneinfo\europe\jersey
%TEMP%\_mei25962\pytz\zoneinfo\europe\kaliningrad
%TEMP%\_mei25962\pytz\zoneinfo\europe\kiev
%TEMP%\_mei25962\pytz\zoneinfo\europe\kirov
%TEMP%\_mei25962\pytz\zoneinfo\europe\vatican
%TEMP%\_mei25962\pytz\zoneinfo\europe\sofia
%TEMP%\_mei25962\pytz\zoneinfo\europe\lisbon
%TEMP%\_mei25962\pytz\zoneinfo\europe\luxembourg
%TEMP%\_mei25962\pytz\zoneinfo\europe\madrid
%TEMP%\_mei25962\pytz\zoneinfo\europe\malta
%TEMP%\_mei25962\pytz\zoneinfo\europe\mariehamn
%TEMP%\_mei25962\pytz\zoneinfo\europe\minsk
%TEMP%\_mei25962\pytz\zoneinfo\europe\monaco
%TEMP%\_mei25962\pytz\zoneinfo\europe\moscow
%TEMP%\_mei25962\pytz\zoneinfo\europe\guernsey
%TEMP%\_mei25962\pytz\zoneinfo\europe\london
%TEMP%\_mei25962\pytz\zoneinfo\europe\vienna
%TEMP%\_mei25962\pytz\zoneinfo\europe\vilnius
%TEMP%\_mei25962\pytz\zoneinfo\europe\volgograd
%TEMP%\_mei25962\pytz\zoneinfo\indian\maldives
%TEMP%\_mei25962\pytz\zoneinfo\indian\mauritius
%TEMP%\_mei25962\pytz\zoneinfo\indian\mayotte
%TEMP%\_mei25962\pytz\zoneinfo\indian\reunion
%TEMP%\_mei25962\pytz\zoneinfo\iran
%TEMP%\_mei25962\pytz\zoneinfo\israel
%TEMP%\_mei25962\pytz\zoneinfo\jamaica
%TEMP%\_mei25962\pytz\zoneinfo\japan
%TEMP%\_mei25962\pytz\zoneinfo\libya
%TEMP%\_mei25962\pytz\zoneinfo\prc
%TEMP%\_mei25962\pytz\zoneinfo\met
%TEMP%\_mei25962\pytz\zoneinfo\mst
%TEMP%\_mei25962\pytz\zoneinfo\mst7mdt
%TEMP%\_mei25962\pytz\zoneinfo\mexico\bajanorte
%TEMP%\_mei25962\pytz\zoneinfo\mexico\bajasur
%TEMP%\_mei25962\pytz\zoneinfo\mexico\general
%TEMP%\_mei25962\pytz\zoneinfo\nz
%TEMP%\_mei25962\pytz\zoneinfo\nz-chat
%TEMP%\_mei25962\pytz\zoneinfo\indian\mahe
%TEMP%\tmpeh8zaweu\user.js
%TEMP%\_mei25962\pytz\zoneinfo\indian\kerguelen
%TEMP%\_mei25962\pytz\zoneinfo\gmt+0
%TEMP%\_mei25962\pytz\zoneinfo\europe\warsaw
%TEMP%\_mei25962\pytz\zoneinfo\europe\zagreb
%TEMP%\_mei25962\pytz\zoneinfo\europe\zaporozhye
%TEMP%\_mei25962\pytz\zoneinfo\europe\zurich
%TEMP%\_mei25962\pytz\zoneinfo\factory
%TEMP%\_mei25962\pytz\zoneinfo\gb
%TEMP%\_mei25962\pytz\zoneinfo\gb-eire
%TEMP%\_mei25962\pytz\zoneinfo\gmt
%TEMP%\_mei25962\pytz\zoneinfo\navajo
%TEMP%\_mei25962\pytz\zoneinfo\indian\cocos
%TEMP%\_mei25962\pytz\zoneinfo\gmt0
%TEMP%\_mei25962\pytz\zoneinfo\greenwich
%TEMP%\_mei25962\pytz\zoneinfo\hst
%TEMP%\_mei25962\pytz\zoneinfo\hongkong
%TEMP%\_mei25962\pytz\zoneinfo\iceland
%TEMP%\_mei25962\pytz\zoneinfo\indian\antananarivo
%TEMP%\_mei25962\pytz\zoneinfo\indian\chagos
%TEMP%\_mei25962\pytz\zoneinfo\indian\christmas
%TEMP%\_mei25962\pytz\zoneinfo\indian\comoro
%TEMP%\_mei25962\selenium\webdriver\firefox\webdriver.xpi
%TEMP%\_mei25962\pytz\zoneinfo\asia\hebron
%TEMP%\_mei25962\pytz\zoneinfo\asia\chongqing
%TEMP%\_mei25962\pytz\zoneinfo\africa\libreville
%TEMP%\_mei25962\pytz\zoneinfo\africa\lome
%TEMP%\_mei25962\pytz\zoneinfo\africa\luanda
%TEMP%\_mei25962\pytz\zoneinfo\africa\lubumbashi
%TEMP%\_mei25962\pytz\zoneinfo\africa\lusaka
%TEMP%\_mei25962\pytz\zoneinfo\africa\malabo
%TEMP%\_mei25962\pytz\zoneinfo\africa\dakar
%TEMP%\_mei25962\pytz\zoneinfo\africa\maputo
%TEMP%\_mei25962\pytz\zoneinfo\africa\mbabane
%TEMP%\_mei25962\pytz\zoneinfo\africa\mogadishu
%TEMP%\_mei25962\pytz\zoneinfo\africa\monrovia
%TEMP%\_mei25962\pytz\zoneinfo\africa\nairobi
%TEMP%\_mei25962\pytz\zoneinfo\africa\ndjamena
%TEMP%\_mei25962\pytz\zoneinfo\africa\niamey
%TEMP%\_mei25962\pytz\zoneinfo\africa\nouakchott
%TEMP%\_mei25962\pytz\zoneinfo\africa\kigali
%TEMP%\_mei25962\pytz\zoneinfo\africa\maseru
%TEMP%\_mei25962\pytz\zoneinfo\africa\lagos
%TEMP%\_mei25962\pytz\zoneinfo\africa\kinshasa
%TEMP%\_mei25962\pytz\zoneinfo\africa\khartoum
%TEMP%\_mei25962\pytz\zoneinfo\africa\kampala
%TEMP%\_mei25962\pytz\zoneinfo\africa\blantyre
%TEMP%\_mei25962\pytz\zoneinfo\africa\brazzaville
%TEMP%\_mei25962\pytz\zoneinfo\africa\bujumbura
%TEMP%\_mei25962\pytz\zoneinfo\africa\cairo
%TEMP%\_mei25962\pytz\zoneinfo\africa\casablanca
%TEMP%\_mei25962\pytz\zoneinfo\africa\ceuta
%TEMP%\_mei25962\pytz\zoneinfo\africa\ouagadougou
%TEMP%\_mei25962\pytz\zoneinfo\africa\conakry
%TEMP%\_mei25962\pytz\zoneinfo\africa\bangui
%TEMP%\_mei25962\pytz\zoneinfo\africa\dar_es_salaam
%TEMP%\_mei25962\pytz\zoneinfo\africa\douala
%TEMP%\_mei25962\pytz\zoneinfo\africa\el_aaiun
%TEMP%\_mei25962\pytz\zoneinfo\africa\freetown
%TEMP%\_mei25962\pytz\zoneinfo\africa\gaborone
%TEMP%\_mei25962\pytz\zoneinfo\africa\harare
%TEMP%\_mei25962\pytz\zoneinfo\africa\johannesburg
%TEMP%\_mei25962\pytz\zoneinfo\africa\banjul
%TEMP%\_mei25962\pytz\zoneinfo\africa\juba
%TEMP%\_mei25962\pytz\zoneinfo\africa\djibouti
%TEMP%\_mei25962\pytz\zoneinfo\africa\bissau
%TEMP%\_mei25962\pytz\zoneinfo\africa\porto-novo
%TEMP%\_mei25962\pytz\zoneinfo\africa\tunis
%TEMP%\_mei25962\pytz\zoneinfo\america\atikokan
%TEMP%\_mei25962\pytz\zoneinfo\america\atka
%TEMP%\_mei25962\pytz\zoneinfo\america\bahia
%TEMP%\_mei25962\pytz\zoneinfo\america\bahia_banderas
%TEMP%\_mei25962\pytz\zoneinfo\america\barbados
%TEMP%\_mei25962\pytz\zoneinfo\america\belem
%TEMP%\_mei25962\pytz\zoneinfo\america\belize
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\tucuman
%TEMP%\_mei25962\pytz\zoneinfo\america\blanc-sablon
%TEMP%\_mei25962\pytz\zoneinfo\america\bogota
%TEMP%\_mei25962\pytz\zoneinfo\america\boise
%TEMP%\_mei25962\pytz\zoneinfo\america\buenos_aires
%TEMP%\_mei25962\pytz\zoneinfo\america\cambridge_bay
%TEMP%\_mei25962\pytz\zoneinfo\america\campo_grande
%TEMP%\_mei25962\pytz\zoneinfo\america\cancun
%TEMP%\_mei25962\pytz\zoneinfo\america\caracas
%TEMP%\_mei25962\pytz\zoneinfo\america\aruba
%TEMP%\_mei25962\pytz\zoneinfo\america\asuncion
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\ushuaia
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\san_luis
%TEMP%\_mei25962\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei25962\pytz\zoneinfo\africa\windhoek
%TEMP%\_mei25962\pytz\zoneinfo\america\adak
%TEMP%\_mei25962\pytz\zoneinfo\america\anchorage
%TEMP%\_mei25962\pytz\zoneinfo\america\anguilla
%TEMP%\_mei25962\pytz\zoneinfo\america\antigua
%TEMP%\_mei25962\pytz\zoneinfo\america\araguaina
%TEMP%\_mei25962\pytz\zoneinfo\africa\sao_tome
%TEMP%\_mei25962\pytz\zoneinfo\africa\tripoli
%TEMP%\_mei25962\pytz\zoneinfo\africa\timbuktu
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\buenos_aires
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\jujuy
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\la_rioja
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\mendoza
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\rio_gallegos
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\salta
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\san_juan
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\catamarca
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\comodrivadavia
%TEMP%\_mei25962\pytz\zoneinfo\america\argentina\cordoba
%TEMP%\_mei25962\pytz\zoneinfo\africa\bamako
%TEMP%\_mei25962\pytz\zoneinfo\africa\asmera
%TEMP%\_mei25962\pytz\zoneinfo\africa\asmara
%TEMP%\_mei25962\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei25962\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei25962\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei25962\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei25962\api-ms-win-core-file-l1-1-0.dll
nul
%TEMP%\_mei25962\vcruntime140.dll
%TEMP%\_mei25962\_bz2.pyd
%TEMP%\_mei25962\_ctypes.pyd
%TEMP%\_mei25962\_decimal.pyd
%TEMP%\_mei25962\_elementtree.pyd
%TEMP%\_mei25962\_hashlib.pyd
%TEMP%\_mei25962\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei25962\_lzma.pyd
%TEMP%\_mei25962\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei25962\_queue.pyd
%TEMP%\_mei25962\_ssl.pyd
%TEMP%\_mei25962\_win32sysloader.pyd
%TEMP%\_mei25962\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei25962\_multiprocessing.pyd
%HOMEPATH%\gtool.exe
%TEMP%\_mei25962\_socket.pyd
%TEMP%\_mei25962\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei25962\win32api.pyd
%TEMP%\_mei25962\win32evtlog.pyd
%TEMP%\_mei25962\win32trace.pyd
%TEMP%\_mei25962\win32ui.pyd
%TEMP%\_mei25962\win32wnet.pyd
%TEMP%\_mei25962\include\pyconfig.h
%TEMP%\_mei25962\base_library.zip
%TEMP%\_mei25962\unicodedata.pyd
%TEMP%\_mei25962\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei25962\win32com\shell\shell.pyd
%TEMP%\_mei25962\certifi\cacert.pem
%TEMP%\_mei25962\lib2to3\patterngrammar3.7.7.final.0.pickle
%TEMP%\_mei25962\lib2to3\tests\data\readme
%TEMP%\_mei25962\pytz\zoneinfo\africa\abidjan
%TEMP%\_mei25962\pytz\zoneinfo\africa\accra
%TEMP%\_mei25962\pytz\zoneinfo\africa\addis_ababa
%TEMP%\_mei25962\pytz\zoneinfo\africa\algiers
%TEMP%\_mei25962\lib2to3\grammar.txt
%TEMP%\_mei25962\lib2to3\grammar3.7.7.final.0.pickle
%TEMP%\_mei25962\lib2to3\patterngrammar.txt
%TEMP%\_mei25962\pytz\zoneinfo\america\boa_vista
%TEMP%\_mei25962\pytz\zoneinfo\america\catamarca
%TEMP%\_mei25962\scenario_search_query.exe.manifest
%TEMP%\_mei25962\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei25962\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei25962\select.pyd
%TEMP%\_mei25962\ucrtbase.dll
%TEMP%\_mei25962\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei25962\libssl-1_1.dll
%TEMP%\_mei25962\mfc140u.dll
%TEMP%\_mei25962\psutil\_psutil_windows.cp37-win_amd64.pyd
%TEMP%\_mei25962\pyexpat.pyd
%TEMP%\_mei25962\python37.dll
%TEMP%\_mei25962\pythoncom37.dll
%TEMP%\_mei25962\pywintypes37.dll
%TEMP%\_mei25962\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei25962\libcrypto-1_1.dll
%TEMP%\_mei25962\pytz\zoneinfo\america\cayenne
%TEMP%\_mei25962\pytz\zoneinfo\america\cayman
%TEMP%\_mei25962\pytz\zoneinfo\america\chicago
%TEMP%\_mei25962\pytz\zoneinfo\america\st_kitts
%TEMP%\_mei25962\pytz\zoneinfo\america\st_lucia
%TEMP%\_mei25962\pytz\zoneinfo\america\st_thomas
%TEMP%\_mei25962\pytz\zoneinfo\america\st_vincent
%TEMP%\_mei25962\pytz\zoneinfo\america\swift_current
%TEMP%\_mei25962\pytz\zoneinfo\america\tegucigalpa
%TEMP%\_mei25962\pytz\zoneinfo\america\thule
%TEMP%\_mei25962\pytz\zoneinfo\america\regina
%TEMP%\_mei25962\pytz\zoneinfo\america\thunder_bay
%TEMP%\_mei25962\pytz\zoneinfo\america\toronto
%TEMP%\_mei25962\pytz\zoneinfo\america\tortola
%TEMP%\_mei25962\pytz\zoneinfo\america\vancouver
%TEMP%\_mei25962\pytz\zoneinfo\america\virgin
%TEMP%\_mei25962\pytz\zoneinfo\america\whitehorse
%TEMP%\_mei25962\pytz\zoneinfo\america\winnipeg
%TEMP%\_mei25962\pytz\zoneinfo\america\yakutat
%TEMP%\_mei25962\pytz\zoneinfo\america\st_barthelemy
%TEMP%\_mei25962\pytz\zoneinfo\america\st_johns
%TEMP%\_mei25962\pytz\zoneinfo\america\sitka
%TEMP%\_mei25962\pytz\zoneinfo\america\shiprock
%TEMP%\_mei25962\pytz\zoneinfo\america\scoresbysund
%TEMP%\_mei25962\pytz\zoneinfo\america\port_of_spain
%TEMP%\_mei25962\pytz\zoneinfo\america\porto_acre
%TEMP%\_mei25962\pytz\zoneinfo\america\porto_velho
%TEMP%\_mei25962\pytz\zoneinfo\america\puerto_rico
%TEMP%\_mei25962\pytz\zoneinfo\america\punta_arenas
%TEMP%\_mei25962\pytz\zoneinfo\america\rainy_river
%TEMP%\_mei25962\pytz\zoneinfo\america\rankin_inlet
%TEMP%\_mei25962\pytz\zoneinfo\america\yellowknife
%TEMP%\_mei25962\pytz\zoneinfo\america\tijuana
%TEMP%\_mei25962\pytz\zoneinfo\america\recife
%TEMP%\_mei25962\pytz\zoneinfo\america\rio_branco
%TEMP%\_mei25962\pytz\zoneinfo\america\rosario
%TEMP%\_mei25962\pytz\zoneinfo\america\santa_isabel
%TEMP%\_mei25962\pytz\zoneinfo\america\santarem
%TEMP%\_mei25962\pytz\zoneinfo\america\santiago
%TEMP%\_mei25962\pytz\zoneinfo\america\santo_domingo
%TEMP%\_mei25962\pytz\zoneinfo\america\sao_paulo
%TEMP%\_mei25962\pytz\zoneinfo\america\port-au-prince
%TEMP%\_mei25962\pytz\zoneinfo\america\resolute
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\casey
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\davis
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\dumontdurville
%TEMP%\_mei25962\pytz\zoneinfo\asia\bangkok
%TEMP%\_mei25962\pytz\zoneinfo\asia\barnaul
%TEMP%\_mei25962\pytz\zoneinfo\asia\beirut
%TEMP%\_mei25962\pytz\zoneinfo\asia\bishkek
%TEMP%\_mei25962\pytz\zoneinfo\asia\brunei
%TEMP%\_mei25962\pytz\zoneinfo\asia\calcutta
%TEMP%\_mei25962\pytz\zoneinfo\asia\chita
%TEMP%\_mei25962\pytz\zoneinfo\asia\choibalsan
%TEMP%\_mei25962\pytz\zoneinfo\asia\chungking
%TEMP%\_mei25962\pytz\zoneinfo\america\phoenix
%TEMP%\_mei25962\pytz\zoneinfo\asia\colombo
%TEMP%\_mei25962\pytz\zoneinfo\asia\dacca
%TEMP%\_mei25962\pytz\zoneinfo\asia\damascus
%TEMP%\_mei25962\pytz\zoneinfo\asia\dhaka
%TEMP%\_mei25962\pytz\zoneinfo\asia\dili
%TEMP%\_mei25962\pytz\zoneinfo\asia\dubai
%TEMP%\_mei25962\pytz\zoneinfo\asia\dushanbe
%TEMP%\_mei25962\pytz\zoneinfo\asia\famagusta
%TEMP%\_mei25962\pytz\zoneinfo\asia\baku
%TEMP%\_mei25962\pytz\zoneinfo\arctic\longyearbyen
%TEMP%\_mei25962\pytz\zoneinfo\asia\bahrain
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\vostok
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\macquarie
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\mawson
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\mcmurdo
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\palmer
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\rothera
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\south_pole
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\syowa
%TEMP%\_mei25962\pytz\zoneinfo\antarctica\troll
%TEMP%\_mei25962\pytz\zoneinfo\asia\harbin
%TEMP%\_mei25962\pytz\zoneinfo\asia\atyrau
%TEMP%\_mei25962\pytz\zoneinfo\asia\aden
%TEMP%\_mei25962\pytz\zoneinfo\asia\almaty
%TEMP%\_mei25962\pytz\zoneinfo\asia\amman
%TEMP%\_mei25962\pytz\zoneinfo\asia\anadyr
%TEMP%\_mei25962\pytz\zoneinfo\asia\aqtau
%TEMP%\_mei25962\pytz\zoneinfo\asia\aqtobe
%TEMP%\_mei25962\pytz\zoneinfo\asia\ashgabat
%TEMP%\_mei25962\pytz\zoneinfo\asia\ashkhabad
%TEMP%\_mei25962\pytz\zoneinfo\asia\baghdad
%TEMP%\_mei25962\pytz\zoneinfo\america\los_angeles
%TEMP%\_mei25962\pytz\zoneinfo\america\paramaribo
%TEMP%\_mei25962\pytz\zoneinfo\america\nassau
%TEMP%\_mei25962\pytz\zoneinfo\america\grand_turk
%TEMP%\_mei25962\pytz\zoneinfo\america\grenada
%TEMP%\_mei25962\pytz\zoneinfo\america\guadeloupe
%TEMP%\_mei25962\pytz\zoneinfo\america\guatemala
%TEMP%\_mei25962\pytz\zoneinfo\america\guayaquil
%TEMP%\_mei25962\pytz\zoneinfo\america\guyana
%TEMP%\_mei25962\pytz\zoneinfo\america\halifax
%TEMP%\_mei25962\pytz\zoneinfo\america\dawson_creek
%TEMP%\_mei25962\pytz\zoneinfo\america\havana
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\indianapolis
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\knox
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\marengo
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\petersburg
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\tell_city
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\vevay
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\vincennes
%TEMP%\_mei25962\pytz\zoneinfo\america\godthab
%TEMP%\_mei25962\pytz\zoneinfo\america\goose_bay
%TEMP%\_mei25962\pytz\zoneinfo\america\glace_bay
%TEMP%\_mei25962\pytz\zoneinfo\america\fortaleza
%TEMP%\_mei25962\pytz\zoneinfo\america\fort_wayne
%TEMP%\_mei25962\pytz\zoneinfo\america\coral_harbour
%TEMP%\_mei25962\pytz\zoneinfo\america\cordoba
%TEMP%\_mei25962\pytz\zoneinfo\america\costa_rica
%TEMP%\_mei25962\pytz\zoneinfo\america\creston
%TEMP%\_mei25962\pytz\zoneinfo\america\cuiaba
%TEMP%\_mei25962\pytz\zoneinfo\america\curacao
%TEMP%\_mei25962\pytz\zoneinfo\america\danmarkshavn
%TEMP%\_mei25962\pytz\zoneinfo\america\indiana\winamac
%TEMP%\_mei25962\pytz\zoneinfo\america\hermosillo
%TEMP%\_mei25962\pytz\zoneinfo\america\dawson
%TEMP%\_mei25962\pytz\zoneinfo\america\detroit
%TEMP%\_mei25962\pytz\zoneinfo\america\dominica
%TEMP%\_mei25962\pytz\zoneinfo\america\edmonton
%TEMP%\_mei25962\pytz\zoneinfo\america\eirunepe
%TEMP%\_mei25962\pytz\zoneinfo\america\el_salvador
%TEMP%\_mei25962\pytz\zoneinfo\america\ensenada
%TEMP%\_mei25962\pytz\zoneinfo\america\fort_nelson
%TEMP%\_mei25962\pytz\zoneinfo\america\chihuahua
%TEMP%\_mei25962\pytz\zoneinfo\america\denver
%TEMP%\_mei25962\pytz\zoneinfo\america\indianapolis
%TEMP%\_mei25962\pytz\zoneinfo\america\inuvik
%TEMP%\_mei25962\pytz\zoneinfo\america\iqaluit
%TEMP%\_mei25962\pytz\zoneinfo\america\metlakatla
%TEMP%\_mei25962\pytz\zoneinfo\america\mexico_city
%TEMP%\_mei25962\pytz\zoneinfo\america\miquelon
%TEMP%\_mei25962\pytz\zoneinfo\america\moncton
%TEMP%\_mei25962\pytz\zoneinfo\america\monterrey
%TEMP%\_mei25962\pytz\zoneinfo\america\montevideo
%TEMP%\_mei25962\pytz\zoneinfo\america\montreal
%TEMP%\_mei25962\pytz\zoneinfo\america\montserrat
%TEMP%\_mei25962\pytz\zoneinfo\america\new_york
%TEMP%\_mei25962\pytz\zoneinfo\america\pangnirtung
%TEMP%\_mei25962\pytz\zoneinfo\america\nipigon
%TEMP%\_mei25962\pytz\zoneinfo\america\nome
%TEMP%\_mei25962\pytz\zoneinfo\america\noronha
%TEMP%\_mei25962\pytz\zoneinfo\america\north_dakota\beulah
%TEMP%\_mei25962\pytz\zoneinfo\america\north_dakota\center
%TEMP%\_mei25962\pytz\zoneinfo\america\north_dakota\new_salem
%TEMP%\_mei25962\pytz\zoneinfo\america\nuuk
%TEMP%\_mei25962\pytz\zoneinfo\america\ojinaga
%TEMP%\_mei25962\pytz\zoneinfo\america\merida
%TEMP%\_mei25962\pytz\zoneinfo\asia\gaza
%TEMP%\_mei25962\pytz\zoneinfo\america\menominee
%TEMP%\_mei25962\pytz\zoneinfo\america\lima
%TEMP%\_mei25962\pytz\zoneinfo\america\jamaica
%TEMP%\_mei25962\pytz\zoneinfo\america\jujuy
%TEMP%\_mei25962\pytz\zoneinfo\america\juneau
%TEMP%\_mei25962\pytz\zoneinfo\america\kentucky\louisville
%TEMP%\_mei25962\pytz\zoneinfo\america\kentucky\monticello
%TEMP%\_mei25962\pytz\zoneinfo\america\knox_in
%TEMP%\_mei25962\pytz\zoneinfo\america\kralendijk
%TEMP%\_mei25962\pytz\zoneinfo\america\la_paz
%TEMP%\_mei25962\pytz\zoneinfo\america\panama
%TEMP%\_mei25962\pytz\zoneinfo\america\mazatlan
%TEMP%\_mei25962\pytz\zoneinfo\america\louisville
%TEMP%\_mei25962\pytz\zoneinfo\america\lower_princes
%TEMP%\_mei25962\pytz\zoneinfo\america\maceio
%TEMP%\_mei25962\pytz\zoneinfo\america\managua
%TEMP%\_mei25962\pytz\zoneinfo\america\manaus
%TEMP%\_mei25962\pytz\zoneinfo\america\marigot
%TEMP%\_mei25962\pytz\zoneinfo\america\martinique
%TEMP%\_mei25962\pytz\zoneinfo\america\matamoros
%TEMP%\_mei25962\pytz\zoneinfo\america\mendoza
%TEMP%\tmpmb752r87\user.js

Deletes the following files

%TEMP%\va99becm

Network activity

Connects to

'localhost':49215

TCP

HTTP POST requests

http://12#.#.0.1:49188/session
http://12#.#.0.1:49197/session
http://12#.#.0.1:49206/session
http://12#.#.0.1:49215/session

'ap###.beecost.com':443

'st####.beecost.com':443

'ap#.#pify.org':443

'lo#.#rdict.com':443

'de#.#uadee.vn':443

'gi##ub.com':443

'gi#############on-release-asset-2e65be.s3.amazonaws.com':443

'localhost':49195

'localhost':49204

'localhost':49213

UDP

DNS ASK ap###.beecost.com
DNS ASK st####.beecost.com
DNS ASK ap#.#pify.org
DNS ASK lo#.#rdict.com
DNS ASK de#.#uadee.vn
DNS ASK gi##ub.com
DNS ASK gi#############on-release-asset-2e65be.s3.amazonaws.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%HOMEPATH%\20201021_gtool_newtab.exe' arg
'%HOMEPATH%\gtool.exe' arg
'<Current directory>\geckodriver.exe' --port 49188
'<Current directory>\geckodriver.exe' --port 49197
'<Current directory>\geckodriver.exe' --port 49206
'<Current directory>\geckodriver.exe' --port 49215

Executes the following

'<SYSTEM32>\arp.exe' -a 10.0.43.24
'<SYSTEM32>\cmd.exe' /c taskkill /f /im geckodriver.exe /T
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%HOMEPATH%\gtool.exe"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней