Ransom.Win32.SODINOKIBI.AUWTU

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のプロセスを追加します。

• powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

他のシステム変更

マルウェアは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows

マルウェアは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GitForWindows
73g = "\xa7:k\x0b\xac[\x84\xd1a3\xff\xaa$\x8e\xa0\xb7v\xa6p\xa0\xc9\x17Z\x8b\xe0\xf4\xe5!X\x0c"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GitForWindows
vTGj = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GitForWindows
Q7PZe = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GitForWindows
BuCrIp = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GitForWindows
lcZd7OY = ".66to56856"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GitForWindows
sLF86MWC = "{random characters}"

作成活動

マルウェアは、以下のファイルを作成します。

• %System Root%\Python27\include\weakrefobject.h.66to56856
• %System Root%\Python27\include\abstract.h.66to56856
• %System Root%\Python27\include\iterobject.h.66to56856
• %System Root%\Python27\include\pgenheaders.h.66to56856
• %System Root%\Python27\Lib\unittest\{username}
• %System Root%\Python27\Lib\_MozillaCookieJar.pyc
• %System Root%\Python27\Lib\sysconfig.py
• %System Root%\Python27\include\pyconfig.h
• %System Root%\Python27\Lib\BaseHTTPServer.py.66to56856
• %System Root%\Python27\Lib\nturl2path.py.66to56856
• %System Root%\Python27\Lib\asyncore.py
• %System Root%\Python27\Lib\Queue.pyc
• %System Root%\Python27\include\node.h.66to56856
• %System Root%\Python27\include\structmember.h
• %System Root%\Python27\Lib\sgmllib.py.66to56856
• %System Root%\Users\{username}\{username}
• %System Root%\Python27\Lib\functools.py
• %System Root%\Python27\Lib\sunau.py.66to56856
• %System Root%\Python27\Lib\markupbase.pyc
• %System Root%\Python27\Lib\dis.py.66to56856
• %System Root%\Python27\Lib\linecache.py
• %System Root%\Python27\Lib\threading.py.66to56856
• %System Root%\Python27\include\pyport.h
• %System Root%\Python27\Lib\curses\has_key.py
• %System Root%\Python27\include\asdl.h.66to56856
• %User Profile%\NTUSER.DAT{{GUID}}.TMContainer00000000000000000002.regtrans-ms.66to56856
• %System Root%\Python27\Lib\getpass.pyc.66to56856
• %System Root%\word2k\DOC2KE03.doc.66to56856
• %System Root%\Python27\include\pycapsule.h
• %System Root%\Python27\Lib\smtpd.py
• %System Root%\Python27\include\unicodeobject.h
• %System Root%\Python27\Lib\audiodev.py.66to56856
• %System Root%\set_hostname.vbs.66to56856
• %System Root%\Python27\Lib\posixpath.pyc
• %System Root%\powerpoint2k\PPT2KE02.ppt
• %System Root%\Python27\Lib\csv.pyc
• %System Root%\Python27\Lib\lib-tk\{username}
• %System Root%\Python27\Lib\os.py.66to56856
• %System Root%\Python27\Lib\imputil.py
• %System Root%\Recovery\{username}
• %System Root%\Python27\DLLs\_tkinter.pyd.66to56856
• %System Root%\Python27\Lib\rlcompleter.py.66to56856
• %System Root%\Python27\Lib\cgi.pyc.66to56856
• %System Root%\Python27\Lib\nturl2path.pyc.66to56856
• %System Root%\Python27\Lib\sre_constants.py
• %System Root%\Python27\Lib\wave.py
• %System Root%\Python27\libs\pyexpat.lib
• %System Root%\Python27\include\structseq.h
• %System Root%\Python27\Lib\collections.pyc.66to56856
• %System Root%\Python27\Lib\robotparser.py
• %System Root%\Python27\Lib\gzip.pyc.66to56856
• %System Root%\Python27\Lib\bsddb\{username}
• %System Root%\Python27\Lib\tempfile.pyc
• %System Root%\Python27\Lib\markupbase.py.66to56856
• %System Root%\Python27\Lib\compileall.pyc
• %System Root%\Python27\include\pyexpat.h
• %System Root%\Python27\Lib\uuid.py.66to56856
• %System Root%\Python27\Lib\mailbox.py.66to56856
• %System Root%\Python27\DLLs\_elementtree.pyd.66to56856
• %System Root%\Python27\Lib\colorsys.py
• %System Root%\Python27\Lib\shutil.py.66to56856
• %System Root%\Python27\Lib\user.py
• %System Root%\Python27\tcl\tcl8\{username}
• %System Root%\Python27\include\cobject.h.66to56856
• %System Root%\Python27\Lib\dbhash.py.66to56856
• %System Root%\Python27\Lib\urllib.pyc
• %System Root%\Python27\Tools\pynche\{username}
• %System Root%\Python27\Lib\httplib.pyc
• %System Root%\powerpoint2k\PPT2KE02.ppt.66to56856
• %System Root%\Python27\Lib\random.py
• %System Root%\Python27\Lib\webbrowser.py
• %System Root%\Python27\include\rangeobject.h
• %System Root%\Python27\Lib\mimetools.pyc
• %System Root%\Python27\include\bytesobject.h.66to56856
• %System Root%\Email and Password List.vbs.66to56856
• %System Root%\Users\Default\NTUSER.DAT{{GUID}}.TM.blf
• %System Root%\Python27\Lib\timeit.py
• %System Root%\Python27\Lib\hashlib.py
• %System Root%\Python27\Lib\this.py
• %System Root%\Python27\Lib\posixfile.py.66to56856
• %System Root%\Python27\Lib\BaseHTTPServer.py
• %System Root%\Python27\Lib\abc.pyc.66to56856
• %System Root%\Python27\Lib\string.pyc
• %System Root%\Python27\Lib\contextlib.py.66to56856
• %System Root%\Python27\include\pyconfig.h.66to56856
• %System Root%\Python27\include\ucnhash.h
• %System Root%\Python27\include\fileobject.h.66to56856
• %System Root%\Python27\Lib\hashlib.pyc
• %System Root%\Python27\Lib\ctypes\wintypes.pyc.66to56856
• %User Profile%\NTUSER.DAT{{GUID}}.TMContainer00000000000000000002.regtrans-ms
• %System Root%\Python27\Lib\repr.py.66to56856
• %System Root%\Python27\Lib\cmd.py
• %System Root%\Python27\Lib\atexit.py
• %System Root%\Python27\include\abstract.h
• %System Root%\Python27\Lib\compiler\pyassem.py
• %System Root%\Python27\Lib\hmac.pyc
• %System Root%\Python27\Lib\httplib.pyc.66to56856
• %System Root%\Python27\Lib\curses\__init__.py.66to56856
• %System Root%\Python27\Lib\code.py.66to56856
• %System Root%\Python27\include\symtable.h.66to56856
• %System Root%\Python27\include\genobject.h.66to56856
• %System Root%\Python27\Lib\user.py.66to56856
• %System Root%\Python27\Lib\decimal.py.66to56856
• %System Root%\Python27\Lib\ctypes\util.pyc
• %System Root%\Python27\Lib\types.pyc.66to56856
• %System Root%\Python27\include\modsupport.h.66to56856
• %System Root%\Python27\Lib\copy.py
• %System Root%\Python27\Lib\ctypes\__init__.py
• %System Root%\Python27\include\pyarena.h.66to56856
• %System Root%\Python27\Lib\_weakrefset.pyc
• %System Root%\Python27\Tools\{username}
• %System Root%\Python27\include\marshal.h.66to56856
• %User Profile%\usb_drive.img
• %System Root%\Python27\include\objimpl.h.66to56856
• %System Root%\Python27\Lib\ctypes\_endian.pyc
• %System Root%\Python27\tcl\tk8.5\{username}
• %System Root%\Python27\Lib\stringprep.py.66to56856
• %System Root%\Python27\Lib\dircache.py
• %System Root%\Python27\Lib\posixpath.pyc.66to56856
• %System Root%\Python27\Lib\bsddb\dbrecio.py
• %System Root%\Python27\include\code.h.66to56856
• %System Root%\Python27\DLLs\_ctypes_test.pyd.66to56856
• %System Root%\Python27\Lib\dummy_thread.py
• %System Root%\Python27\Lib\modulefinder.py.66to56856
• %System Root%\Python27\Lib\urllib2.pyc
• %System Root%\Python27\Lib\io.py
• %System Root%\Python27\Lib\_abcoll.pyc
• %System Root%\Python27\Lib\inspect.py.66to56856
• %System Root%\Python27\Lib\bisect.pyc.66to56856
• %System Root%\Python27\include\opcode.h.66to56856
• %System Root%\Python27\libs\winsound.lib
• %System Root%\Users\Public\recorded tv\{username}
• %System Root%\excel2k\XLS2KE05.xls
• %System Root%\Users\{username}\Music\{username}
• %System Root%\Email and Password List.htm
• %System Root%\excel2k\{username}
• %System Root%\Python27\Lib\_strptime.pyc
• %System Root%\Python27\include\tupleobject.h
• %System Root%\Python27\Lib\shlex.py
• %System Root%\Python27\Lib\ctypes\util.pyc.66to56856
• %System Root%\Python27\Lib\subprocess.py
• %System Root%\Python27\include\cellobject.h
• %System Root%\Python27\Lib\sre_compile.pyc.66to56856
• %System Root%\Python27\Lib\ssl.pyc.66to56856
• %System Root%\Python27\Lib\this.py.66to56856
• %System Root%\Python27\Lib\pydoc.py
• %System Root%\Python27\include\bytearrayobject.h
• %User Profile%\documents\{username}
• %System Root%\Python27\libs\_ctypes_test.lib
• %System Root%\Python27\Lib\encodings\{username}
• %System Root%\Python27\Lib\statvfs.py.66to56856
• %System Root%\Python27\DLLs\_socket.pyd
• %System Root%\Python27\Lib\sysconfig.pyc.66to56856
• %System Root%\Python27\Lib\fractions.py
• %System Root%\Python27\DLLs\_sqlite3.pyd
• %System Root%\Python27\Lib\bsddb\dbutils.py.66to56856
• %System Root%\Python27\Lib\compiler\__init__.py.66to56856
• %System Root%\Python27\Lib\httplib.py.66to56856
• %System Root%\Python27\Lib\quopri.py.66to56856
• %System Root%\Python27\Lib\multiprocessing\{username}
• %System Root%\Python27\Lib\site.py.66to56856
• %System Root%\Python27\Lib\plistlib.py.66to56856
• %System Root%\Python27\include\timefuncs.h.66to56856
• %System Root%\Python27\include\errcode.h.66to56856
• %System Root%\Python27\Lib\trace.py.66to56856
• %System Root%\Python27\libs\_testcapi.lib.66to56856
• %System Root%\Python27\Lib\xmlrpclib.py.66to56856
• %System Root%\Python27\Lib\hashlib.pyc.66to56856
• %System Root%\Python27\Lib\runpy.pyc
• %System Root%\Python27\Lib\argparse.py.66to56856
• %System Root%\Python27\Lib\zipfile.pyc
• %System Root%\Python27\Lib\ctypes\wintypes.pyc
• %System Root%\Python27\Lib\subprocess.pyc
• %System Root%\Python27\tcl\tclstub85.lib.66to56856
• %System Root%\Python27\Lib\compileall.py.66to56856
• %System Root%\Python27\Lib\doctest.py.66to56856
• %System Root%\Python27\DLLs\_multiprocessing.pyd.66to56856
• %System Root%\Users\Default\NTUSER.DAT{{GUID}}.TMContainer00000000000000000002.regtrans-ms
• %System Root%\Python27\include\pymath.h
• %System Root%\word2k\DOC2KE00.dot.66to56856
• %System Root%\Python27\Lib\fnmatch.py.66to56856
• %System Root%\Python27\Doc\{username}
• %System Root%\Python27\Lib\test\{username}
• %System Root%\Python27\Lib\calendar.py.66to56856
• %System Root%\Python27\Lib\curses\wrapper.py
• %System Root%\Python27\Lib\urlparse.py
• %System Root%\Python27\Lib\mimetypes.py.66to56856
• %System Root%\Python27\Lib\fractions.pyc.66to56856
• %System Root%\Python27\Lib\contextlib.py
• %System Root%\Python27\include\datetime.h
• %System Root%\Python27\include\iterobject.h
• %System Root%\Python27\Lib\nntplib.py
• %System Root%\Python27\Lib\pkgutil.pyc
• %System Root%\Python27\Lib\ssl.py.66to56856
• %System Root%\Python27\include\errcode.h
• %System Root%\Python27\Lib\telnetlib.py.66to56856
• %System Root%\Python27\Lib\ihooks.py.66to56856
• %System Root%\Users\{username}\Videos\{username}
• %System Root%\Python27\Lib\traceback.pyc.66to56856
• %System Root%\Python27\Lib\zipfile.py.66to56856
• %System Root%\Python27\Lib\audiodev.py
• %System Root%\Python27\include\pymath.h.66to56856
• %System Root%\Python27\tcl\{username}
• %System Root%\Python27\Lib\keyword.pyc
• %System Root%\Python27\Lib\opcode.py
• %System Root%\Python27\Lib\urllib2.py.66to56856
• %System Root%\Python27\Lib\zipfile.py
• %System Root%\Python27\Lib\pdb.py
• %System Root%\Python27\Lib\cgitb.py
• %System Root%\Python27\Lib\shutil.pyc
• %System Root%\Python27\include\import.h
• %System Root%\Python27\Lib\locale.pyc.66to56856
• %System Root%\Email and Password List.txt
• %System Root%\Python27\Lib\curses\panel.py.66to56856
• %System Root%\excel2k\XLS2KExx.xls
• %System Root%\Python27\Lib\urlparse.pyc
• %System Root%\Python27\Lib\netrc.pyc
• %System Root%\Python27\Lib\HTMLParser.pyc
• %System Root%\Python27\include\parsetok.h.66to56856
• %System Root%\Python27\include\pyfpe.h.66to56856
• %System Root%\Python27\libs\_msi.lib
• %System Root%\Python27\Lib\bsddb\dbutils.py
• %System Root%\Python27\Lib\os2emxpath.py.66to56856
• %System Root%\Python27\Lib\gettext.py
• %System Root%\Python27\Lib\_MozillaCookieJar.pyc.66to56856
• %System Root%\Python27\include\funcobject.h
• %System Root%\Python27\Lib\bsddb\__init__.py
• %System Root%\Python27\Lib\mailcap.py.66to56856
• %System Root%\Python27\include\funcobject.h.66to56856
• %System Root%\Python27\include\Python.h.66to56856
• %System Root%\Python27\DLLs\_bsddb.pyd.66to56856
• %System Root%\Python27\Lib\codeop.py
• %System Root%\Python27\Lib\opcode.pyc
• %System Root%\Python27\Lib\trace.py
• %System Root%\Python27\libs\libpython27.a
• %System Root%\Python27\Lib\py_compile.pyc.66to56856
• %System Root%\Python27\include\ast.h.66to56856
• %System Root%\Python27\include\ceval.h.66to56856
• %System Root%\Python27\include\pymacconfig.h
• %System Root%\Python27\Lib\types.pyc
• %User Profile%\saved games\{username}
• %System Root%\Email and Password List.js
• %System Root%\Python27\Lib\compiler\misc.py.66to56856
• %System Root%\Python27\Lib\bisect.py.66to56856
• %System Root%\Python27\Lib\compiler\pyassem.py.66to56856
• %System Root%\Python27\Lib\Cookie.pyc.66to56856
• %System Root%\excel2k\XLS2KE02.xls.66to56856
• %System Root%\Python27\Lib\imaplib.py.66to56856
• %System Root%\Python27\Lib\ftplib.py
• %System Root%\Python27\Lib\formatter.py.66to56856
• %System Root%\Python27\include\patchlevel.h
• %System Root%\Python27\Lib\stringprep.pyc
• %System Root%\Python27\Lib\_abcoll.py.66to56856
• %System Root%\Python27\Lib\Queue.py
• %System Root%\Python27\Lib\urllib.pyc.66to56856
• %System Root%\Python27\Lib\getpass.py
• %System Root%\Python27\Lib\tokenize.pyc
• %System Root%\Users\Public\Pictures\{username}
• %System Root%\Python27\include\methodobject.h
• %System Root%\Python27\Lib\keyword.pyc.66to56856
• %System Root%\Python27\Lib\ctypes\util.py
• %System Root%\Python27\include\setobject.h.66to56856
• %System Root%\Python27\Lib\optparse.py
• %System Root%\Python27\Lib\ctypes\__init__.pyc
• %System Root%\Python27\tcl\tcl8.5\{username}
• %System Root%\Python27\Lib\shelve.py
• %System Root%\powerpoint2k\PPT2KExx.PPT.66to56856
• %System Root%\Python27\Lib\argparse.pyc.66to56856
• %System Root%\Users\Public\favorites\{username}
• %System Root%\Python27\Lib\hmac.pyc.66to56856
• %System Root%\Python27\include\traceback.h.66to56856
• %System Root%\Python27\Lib\dbhash.py
• %System Root%\Python27\Lib\tarfile.py
• %System Root%\Python27\Lib\CGIHTTPServer.py.66to56856
• %System Root%\Python27\Lib\compiler\ast.py
• %System Root%\Python27\include\py_curses.h.66to56856
• %System Root%\Python27\Lib\collections.py.66to56856
• %System Root%\Python27\Lib\dis.py
• %System Root%\Python27\Lib\bisect.pyc
• %System Root%\Python27\Lib\bsddb\db.py.66to56856
• %System Root%\Python27\Lib\uu.pyc.66to56856
• %System Root%\Python27\libs\{username}
• %System Root%\Python27\Lib\glob.py.66to56856
• %System Root%\Python27\Lib\HTMLParser.pyc.66to56856
• %System Root%\Python27\Lib\bsddb\dbtables.py
• %System Root%\Python27\Lib\traceback.py
• %System Root%\Python27\Lib\tabnanny.py
• %System Root%\Python27\Lib\ctypes\{username}
• %System Root%\Python27\Lib\StringIO.py
• %System Root%\Python27\libs\_msi.lib.66to56856
• %System Root%\Python27\include\sysmodule.h.66to56856
• %System Root%\word2k\DOC2KE04.doc.66to56856
• %System Root%\Python27\include\dtoa.h
• %System Root%\Python27\Lib\SimpleHTTPServer.py.66to56856
• %System Root%\Python27\Lib\tty.py
• %System Root%\Python27\Lib\htmllib.py
• %System Root%\Python27\Lib\io.pyc.66to56856
• %System Root%\Python27\include\symtable.h
• %System Root%\Python27\Lib\stringprep.pyc.66to56856
• %System Root%\Python27\Lib\rexec.py
• %User Profile%\NTUSER.DAT{{GUID}}.TM.blf
• %System Root%\Python27\Lib\getopt.pyc.66to56856
• %System Root%\Python27\Lib\struct.pyc.66to56856
• %System Root%\Python27\Lib\tty.py.66to56856
• %System Root%\Python27\Lib\curses\wrapper.py.66to56856
• %System Root%\Python27\include\graminit.h
• %System Root%\Python27\Lib\pprint.py.66to56856
• %System Root%\Python27\Lib\stringold.py.66to56856
• %System Root%\Python27\include\descrobject.h
• %System Root%\Python27\Lib\genericpath.pyc.66to56856
• %System Root%\Python27\include\node.h
• %System Root%\Python27\Lib\ensurepip\{username}
• %System Root%\Python27\Lib\functools.py.66to56856
• %System Root%\Python27\include\boolobject.h
• %System Root%\Python27\LICENSE.txt
• %System Root%\Python27\Lib\glob.pyc
• %System Root%\Python27\Lib\gettext.pyc.66to56856
• %System Root%\Python27\DLLs\_tkinter.pyd
• %System Root%\Python27\Lib\site-packages\{username}
• %System Root%\Python27\Lib\plistlib.pyc.66to56856
• %System Root%\Python27\Lib\site.pyc.66to56856
• %System Root%\Python27\Lib\ssl.pyc
• %System Root%\Python27\include\pydebug.h
• %System Root%\powerpoint2k\PPT2KExx.PPT
• %System Root%\Python27\libs\_bsddb.lib
• %System Root%\Python27\Lib\shlex.py.66to56856
• %System Root%\Python27\Lib\warnings.pyc.66to56856
• %System Root%\Python27\Lib\colorsys.py.66to56856
• %System Root%\word2k\DOC2KE01.doc
• %System Root%\Python27\Lib\distutils\archive_util.py
• %System Root%\Python27\Lib\rexec.py.66to56856
• %System Root%\Python27\Lib\opcode.py.66to56856
• %System Root%\Python27\Lib\_strptime.pyc.66to56856
• %System Root%\Python27\Lib\ctypes\_endian.pyc.66to56856
• %System Root%\Python27\Lib\__future__.py
• %System Root%\Python27\include\tupleobject.h.66to56856
• %System Root%\Python27\libs\_multiprocessing.lib
• %System Root%\Python27\Lib\warnings.pyc
• %System Root%\Python27\Lib\pipes.py
• %System Root%\Python27\Lib\compiler\future.py
• %System Root%\Python27\Lib\locale.pyc
• %System Root%\AVScanner.ini.66to56856
• %System Root%\Python27\tcl\dde1.3\{username}
• %System Root%\Python27\Lib\ntpath.pyc
• %System Root%\Python27\Lib\pyclbr.py
• %System Root%\Python27\Lib\runpy.py.66to56856
• %System Root%\Python27\Lib\argparse.py
• %System Root%\Python27\include\pyarena.h
• %System Root%\Python27\Lib\pty.py
• %System Root%\Python27\include\listobject.h
• %System Root%\Python27\Lib\shutil.py
• %System Root%\Python27\Lib\cookielib.pyc
• %System Root%\Python27\Tools\Scripts\{username}
• %System Root%\Python27\Lib\_weakrefset.py
• %System Root%\Python27\include\intrcheck.h
• %System Root%\Python27\Lib\stringold.py
• %System Root%\Python27\Lib\_strptime.py
• %System Root%\Python27\Lib\netrc.pyc.66to56856
• %System Root%\Python27\Lib\warnings.py
• %System Root%\Python27\include\sysmodule.h
• %System Root%\Python27\Lib\robotparser.py.66to56856
• %User Profile%\Music\{username}
• %System Root%\Python27\Lib\nturl2path.pyc
• %System Root%\Python27\Lib\toaiff.py.66to56856
• %System Root%\Python27\Lib\tempfile.py
• %System Root%\Python27\include\descrobject.h.66to56856
• %System Root%\Python27\Lib\_weakrefset.py.66to56856
• %System Root%\Users\Default\Links\{username}
• %System Root%\Python27\Lib\token.py.66to56856
• %System Root%\Python27\Lib\fnmatch.pyc
• %System Root%\Python27\Lib\compiler\symbols.py
• %System Root%\word2k\DOC2KE05.doc
• %System Root%\Users\Public\{username}
• %System Root%\Python27\include\longintrepr.h
• %System Root%\Python27\include\pystrcmp.h.66to56856
• %System Root%\Python27\Lib\struct.pyc
• %System Root%\Python27\Lib\Bastion.py.66to56856
• %System Root%\Python27\Lib\numbers.pyc.66to56856
• %System Root%\Python27\include\intobject.h.66to56856
• %System Root%\Recovery\{GUID}\Winre.wim
• %System Root%\Python27\Lib\sre_parse.pyc
• %System Root%\Python27\Lib\getopt.py.66to56856
• %System Root%\word2k\DOC2KExx.doc.66to56856
• %System Root%\Python27\include\pyfpe.h
• %System Root%\Python27\tcl\tcl85.lib.66to56856
• %System Root%\Python27\DLLs\{username}
• %System Root%\Python27\README.txt
• %System Root%\Python27\Lib\keyword.py
• %System Root%\Python27\Lib\symbol.py.66to56856
• %System Root%\Email and Password List.htm.66to56856
• %System Root%\Python27\Lib\modulefinder.py
• %System Root%\Python27\Lib\runpy.pyc.66to56856
• %System Root%\Python27\Lib\copy.py.66to56856
• %System Root%\Python27\Lib\bisect.py
• %System Root%\excel2k\XLS2KE00.xlt
• %System Root%\Python27\Lib\cgitb.py.66to56856
• %System Root%\Python27\Lib\fpformat.py.66to56856
• %System Root%\Python27\Lib\hmac.py.66to56856
• %System Root%\Python27\Lib\ctypes\_endian.py
• %System Root%\Python27\Lib\xdrlib.py.66to56856
• %System Root%\Python27\Lib\symtable.py
• %System Root%\Python27\Lib\string.pyc.66to56856
• %System Root%\Python27\libs\python27.lib
• %System Root%\Python27\include\Python-ast.h.66to56856
• %System Root%\Python27\Lib\fractions.py.66to56856
• %System Root%\Python27\Lib\ConfigParser.py.66to56856
• %System Root%\Users\{username}
• %System Root%\Python27\Lib\antigravity.py
• %System Root%\Python27\Lib\shlex.pyc
• %System Root%\Python27\Lib\macurl2path.py.66to56856
• %System Root%\Python27\Lib\mutex.py
• %System Root%\Python27\Lib\_MozillaCookieJar.py
• %System Root%\Python27\Lib\asynchat.py
• %System Root%\Python27\Lib\compiler\syntax.py.66to56856
• %System Root%\Python27\Lib\DocXMLRPCServer.py.66to56856
• %System Root%\Python27\Lib\subprocess.pyc.66to56856
• %System Root%\Python27\include\pyctype.h
• %System Root%\Python27\Lib\platform.py
• %System Root%\Python27\Lib\hmac.py
• %System Root%\Python27\Lib\token.pyc
• %System Root%\Python27\tcl\tclConfig.sh.66to56856
• %System Root%\Python27\Lib\logging\{username}
• %System Root%\Python27\Lib\pickle.py.66to56856
• %System Root%\Python27\include\pgenheaders.h
• %System Root%\Python27\include\cStringIO.h.66to56856
• %System Root%\Python27\Lib\dummy_threading.py.66to56856
• %System Root%\Users\Default\Pictures\{username}
• %System Root%\powerpoint2k\PPT2KE04.ppt.66to56856
• %System Root%\Python27\Lib\posixpath.py.66to56856
• %System Root%\Python27\Lib\pprint.py
• %System Root%\Python27\Lib\socket.pyc
• %System Root%\Python27\libs\select.lib.66to56856
• %System Root%\Python27\Lib\pstats.py.66to56856
• %System Root%\Python27\DLLs\_multiprocessing.pyd
• %System Root%\Python27\Lib\types.py.66to56856
• %System Root%\Python27\Lib\json\{username}
• %System Root%\Python27\include\frameobject.h
• %System Root%\Python27\Lib\locale.py
• %System Root%\Python27\Lib\optparse.py.66to56856
• %System Root%\Python27\Lib\pickletools.py
• %System Root%\Python27\DLLs\bz2.pyd
• %System Root%\Python27\Lib\curses\__init__.py
• %System Root%\Python27\Lib\atexit.pyc
• %System Root%\Python27\DLLs\_msi.pyd
• %System Root%\Python27\Lib\pkgutil.py.66to56856
• %System Root%\Python27\Lib\quopri.pyc.66to56856
• %System Root%\Python27\include\bytes_methods.h
• %System Root%\Python27\Lib\types.py
• %System Root%\Python27\Lib\_threading_local.py.66to56856
• %System Root%\Users\Public\downloads\{username}
• %System Root%\Python27\include\unicodeobject.h.66to56856
• %System Root%\Python27\Lib\pstats.py
• %System Root%\Python27\Lib\ctypes\__init__.pyc.66to56856
• %System Root%\Python27\Lib\_threading_local.py
• %System Root%\Python27\Lib\email\{username}
• %User Profile%\downloads\{username}
• %System Root%\Python27\Lib\antigravity.py.66to56856
• %System Root%\Python27\Lib\abc.pyc
• %System Root%\powerpoint2k\PPT2KE03.ppt
• %System Root%\Python27\include\pygetopt.h.66to56856
• %System Root%\Python27\NEWS.txt.66to56856
• %System Root%\Python27\Lib\netrc.py
• %System Root%\Python27\Lib\CGIHTTPServer.py
• %System Root%\Python27\Lib\new.py.66to56856
• %System Root%\Python27\tcl\tclConfig.sh
• %System Root%\Python27\Lib\bsddb\dbrecio.py.66to56856
• %User Profile%\Contacts\{username}
• %System Root%\Python27\Lib\compiler\syntax.py
• %System Root%\Python27\Lib\ctypes\_endian.py.66to56856
• %System Root%\Users\Public\Music\{username}
• %System Root%\Python27\Lib\mimetypes.pyc.66to56856
• %System Root%\word2k\DOC2KE03.doc
• %System Root%\Python27\include\code.h
• %System Root%\Python27\Lib\ConfigParser.pyc.66to56856
• %System Root%\Python27\Lib\py_compile.py.66to56856
• %System Root%\Python27\Lib\compiler\visitor.py.66to56856
• %System Root%\Python27\Lib\codeop.py.66to56856
• %System Root%\Python27\include\moduleobject.h.66to56856
• %System Root%\Python27\include\codecs.h
• %System Root%\Python27\Lib\imghdr.py
• %System Root%\Python27\include\pgen.h
• %System Root%\Email and Password List.txt.66to56856
• %System Root%\Python27\Lib\rfc822.pyc
• %System Root%\Python27\Lib\uu.py
• %System Root%\Python27\Lib\macurl2path.py
• %System Root%\Python27\Lib\plistlib.pyc
• %System Root%\Python27\Lib\abc.py.66to56856
• %System Root%\Python27\Lib\distutils\archive_util.py.66to56856
• %System Root%\Python27\Lib\functools.pyc.66to56856
• %System Root%\Python27\tcl\tkstub85.lib.66to56856
• %System Root%\Python27\include\intobject.h
• %System Root%\Python27\Lib\chunk.py
• %System Root%\Python27\Lib\dummy_threading.py
• %System Root%\Python27\include\pythonrun.h
• %System Root%\Python27\include\bitset.h
• %System Root%\Python27\include\pyport.h.66to56856
• %System Root%\Python27\Lib\sha.py.66to56856
• %System Root%\Python27\Lib\platform.py.66to56856
• %System Root%\Python27\include\cellobject.h.66to56856
• %Favorites%\{username}
• %System Root%\excel2k\XLS2KE01.xls
• %System Root%\Python27\Lib\ConfigParser.pyc
• %System Root%\Python27\Lib\importlib\{username}
• %System Root%\Python27\Lib\heapq.pyc
• %System Root%\Python27\Lib\heapq.py
• %System Root%\Python27\libs\bz2.lib.66to56856
• %System Root%\Python27\include\boolobject.h.66to56856
• %System Root%\Python27\include\pgen.h.66to56856
• %System Root%\Python27\Lib\compiler\symbols.py.66to56856
• %System Root%\Users\{username}\Pictures\{username}
• %System Root%\Python27\Lib\csv.pyc.66to56856
• %System Root%\Python27\Lib\sre_parse.py.66to56856
• %System Root%\Python27\include\ceval.h
• %System Root%\Python27\include\import.h.66to56856
• %System Root%\Python27\Lib\whichdb.py.66to56856
• %System Root%\Python27\Lib\weakref.pyc
• %System Root%\Python27\Lib\sre_parse.pyc.66to56856
• %System Root%\Python27\DLLs\winsound.pyd
• %System Root%\Python27\include\bytearrayobject.h.66to56856
• %System Root%\Python27\Lib\aifc.py.66to56856
• %System Root%\Python27\include\cStringIO.h
• %System Root%\Python27\Lib\re.py
• %System Root%\Python27\Lib\runpy.py
• %System Root%\Python27\Lib\BaseHTTPServer.pyc
• %System Root%\Python27\Lib\sre_compile.pyc
• %System Root%\Python27\include\pymem.h
• %System Root%\Python27\Lib\stringprep.py
• %System Root%\Python27\Lib\weakref.py
• %System Root%\Python27\Lib\socket.pyc.66to56856
• %System Root%\Python27\Lib\sre_compile.py.66to56856
• %System Root%\Python27\Lib\tkinter\{username}
• %System Root%\Python27\Lib\struct.py
• %System Root%\excel2k\XLS2KE02.xls
• %System Root%\Python27\Lib\MimeWriter.py
• %System Root%\Python27\libs\_ssl.lib.66to56856
• %System Root%\Python27\include\cobject.h
• %System Root%\Python27\Lib\subprocess.py.66to56856
• %System Root%\Python27\Lib\hashlib.py.66to56856
• %System Root%\Python27\include\memoryobject.h
• %System Root%\Python27\Lib\py_compile.py
• %System Root%\excel2k\XLS2KE05.xls.66to56856
• %System Root%\Python27\Lib\bsddb\__init__.py.66to56856
• %System Root%\Users\Default\favorites\{username}
• %System Root%\Python27\Lib\_LWPCookieJar.pyc.66to56856
• %System Root%\Python27\Lib\traceback.py.66to56856
• %System Root%\Python27\Lib\numbers.py.66to56856
• %System Root%\Python27\Lib\ctypes\test\{username}
• %System Root%\Python27\Lib\htmlentitydefs.pyc
• %System Root%\Python27\Lib\wave.py.66to56856
• %System Root%\Python27\Lib\curses\ascii.py.66to56856
• %System Root%\Python27\Lib\__phello__.foo.py
• %System Root%\Python27\Lib\contextlib.pyc.66to56856
• %System Root%\Python27\Lib\urllib.py
• %System Root%\word2k\DOC2KE01.doc.66to56856
• %System Root%\Python27\Lib\pprint.pyc.66to56856
• %System Root%\Python27\tcl\tcl85.lib
• %System Root%\word2k\DOC2KE02.doc.66to56856
• %System Root%\Python27\DLLs\_ctypes.pyd
• %System Root%\Python27\Lib\htmlentitydefs.pyc.66to56856
• %System Root%\Python27\Lib\SimpleXMLRPCServer.py.66to56856
• %System Root%\Python27\DLLs\_elementtree.pyd
• %System Root%\Python27\Lib\getpass.py.66to56856
• %System Root%\Users\Default\saved games\{username}
• %System Root%\Python27\Lib\abc.py
• %System Root%\Python27\DLLs\_ssl.pyd
• %System Root%\Python27\Lib\repr.py
• %System Root%\Python27\Lib\lib2to3\{username}
• %System Root%\Python27\Lib\fpformat.py
• %System Root%\Python27\Lib\platform.pyc.66to56856
• %System Root%\Python27\Lib\atexit.py.66to56856
• %System Root%\Python27\Lib\compiler\consts.py
• %System Root%\Python27\Lib\collections.pyc
• %System Root%\Python27\Lib\binhex.py.66to56856
• %System Root%\Python27\Lib\md5.py.66to56856
• %System Root%\Python27\Lib\numbers.pyc
• %System Root%\Python27\Lib\UserDict.pyc.66to56856
• %System Root%\Python27\Lib\sndhdr.py.66to56856
• %System Root%\Python27\include\longobject.h
• %System Root%\Python27\libs\python27.lib.66to56856
• %System Root%\Python27\Lib\Queue.pyc.66to56856
• %System Root%\Python27\Lib\ssl.py
• %System Root%\Python27\Lib\stat.py
• %System Root%\Python27\Lib\anydbm.py.66to56856
• %System Root%\Python27\Lib\compileall.py
• %System Root%\Python27\include\warnings.h.66to56856
• %System Root%\Python27\Lib\imghdr.py.66to56856
• %System Root%\Python27\Lib\gzip.py.66to56856
• %System Root%\Python27\include\methodobject.h.66to56856
• %System Root%\Python27\Lib\random.py.66to56856
• %System Root%\Python27\Lib\site.pyc
• %System Root%\Python27\Lib\aifc.py
• %System Root%\Python27\Lib\pkgutil.pyc.66to56856
• %System Root%\Python27\include\token.h.66to56856
• %System Root%\Python27\Lib\_pyio.py.66to56856
• %System Root%\Python27\Lib\ntpath.py
• %System Root%\Python27\Lib\zipfile.pyc.66to56856
• %System Root%\Python27\Lib\nturl2path.py
• %System Root%\Python27\Lib\fnmatch.py
• %System Root%\Python27\include\classobject.h.66to56856
• %System Root%\Python27\Lib\ihooks.py
• %System Root%\Python27\Lib\curses\{username}
• %System Root%\Python27\Lib\__future__.py.66to56856
• %System Root%\Python27\DLLs\_testcapi.pyd.66to56856
• %System Root%\Python27\Lib\urllib2.py
• %System Root%\Python27\Lib\pydoc.py.66to56856
• %System Root%\Python27\include\pygetopt.h
• %System Root%\Python27\Lib\calendar.py
• %System Root%\Python27\include\structmember.h.66to56856
• %System Root%\Python27\Lib\popen2.py.66to56856
• %System Root%\Python27\Lib\genericpath.pyc
• %System Root%\Python27\libs\_sqlite3.lib
• %System Root%\Python27\DLLs\_bsddb.pyd
• %System Root%\word2k\DOC2KExx.doc
• %System Root%\Python27\Lib\string.py.66to56856
• %System Root%\Users\Default\{username}
• %System Root%\Python27\Lib\sunau.py
• %System Root%\Python27\Lib\UserDict.pyc
• %System Root%\Python27\Lib\compiler\future.py.66to56856
• %System Root%\Python27\include\complexobject.h
• %System Root%\Python27\Lib\_MozillaCookieJar.py.66to56856
• %System Root%\Python27\Lib\urllib2.pyc.66to56856
• %System Root%\Python27\include\bufferobject.h.66to56856
• %System Root%\Python27\Lib\UserString.py.66to56856
• %System Root%\Python27\Lib\_LWPCookieJar.py
• %System Root%\Python27\include\ucnhash.h.66to56856
• %System Root%\Python27\Lib\pickletools.py.66to56856
• %System Root%\Python27\Lib\cProfile.py.66to56856
• %System Root%\Python27\Lib\decimal.pyc
• %System Root%\Python27\Lib\collections.py
• %System Root%\Python27\Lib\compiler\__init__.py
• %System Root%\Recovery\{GUID}\boot.sdi
• %System Root%\Python27\Lib\getpass.pyc
• %System Root%\Python27\Lib\multifile.py.66to56856
• %System Root%\Python27\Lib\sndhdr.py
• %System Root%\Python27\Lib\Queue.py.66to56856
• %System Root%\Python27\include\object.h.66to56856
• %System Root%\Python27\Lib\sched.py.66to56856
• %System Root%\Python27\Lib\pyclbr.py.66to56856
• %System Root%\powerpoint2k\PPT2KE03.ppt.66to56856
• %System Root%\Python27\include\weakrefobject.h
• %System Root%\Python27\Lib\gzip.pyc
• %System Root%\Python27\Lib\smtpd.py.66to56856
• %System Root%\Python27\Lib\sysconfig.py.66to56856
• %System Root%\Python27\Lib\UserList.py.66to56856
• %System Root%\Python27\include\pymem.h.66to56856
• %System Root%\Python27\include\eval.h
• %System Root%\Python27\include\pystrcmp.h
• %System Root%\Python27\Lib\ast.py
• %System Root%\Python27\Lib\xmllib.py.66to56856
• %System Root%\Python27\Lib\threading.pyc
• %System Root%\Python27\Lib\weakref.pyc.66to56856
• %System Root%\Python27\include\patchlevel.h.66to56856
• %System Root%\Python27\Lib\timeit.py.66to56856
• %System Root%\Python27\Lib\weakref.py.66to56856
• %System Root%\Python27\Lib\curses\textpad.py
• %System Root%\Python27\Lib\sqlite3\{username}
• %System Root%\Python27\Lib\SocketServer.py
• %System Root%\Python27\Lib\io.py.66to56856
• %System Root%\Python27\include\structseq.h.66to56856
• %System Root%\Python27\Lib\base64.py.66to56856
• %System Root%\Users\Default\Videos\{username}
• %System Root%\Python27\Lib\inspect.pyc.66to56856
• %System Root%\Python27\DLLs\select.pyd
• %System Root%\Python27\Lib\heapq.pyc.66to56856
• %System Root%\Python27\Lib\plistlib.py
• %System Root%\Python27\Lib\io.pyc
• %System Root%\Python27\Lib\compiler\pycodegen.py.66to56856
• %System Root%\Python27\tcl\tk85.lib
• %System Root%\Python27\include\bufferobject.h
• %System Root%\Python27\DLLs\winsound.pyd.66to56856
• %System Root%\Python27\Lib\_LWPCookieJar.py.66to56856
• %System Root%\excel2k\XLS2KE04.xls
• %System Root%\Python27\Lib\smtplib.py
• %System Root%\word2k\DOC2KE00.dot
• %System Root%\Python27\include\parsetok.h
• %System Root%\Python27\Lib\textwrap.py.66to56856
• %System Root%\Python27\Lib\_weakrefset.pyc.66to56856
• %System Root%\Python27\Lib\ctypes\wintypes.py.66to56856
• %System Root%\Python27\Lib\htmllib.py.66to56856
• %System Root%\Python27\Lib\csv.py.66to56856
• %System Root%\Python27\Lib\SimpleHTTPServer.py
• %System Root%\Python27\include\objimpl.h
• %System Root%\Python27\Lib\difflib.py.66to56856
• %System Root%\Python27\tcl\reg1.2\{username}
• %System Root%\Python27\Lib\__phello__.foo.py.66to56856
• %System Root%\Python27\libs\_elementtree.lib
• %System Root%\Python27\Lib\macpath.py
• %System Root%\Python27\Tools\webchecker\{username}
• %System Root%\Python27\Lib\SocketServer.pyc
• %System Root%\Python27\Lib\uuid.py
• %System Root%\Users\Public\Videos\{username}
• %System Root%\Python27\Lib\os.py
• %System Root%\Python27\Lib\_abcoll.pyc.66to56856
• %System Root%\Python27\libs\pyexpat.lib.66to56856
• %System Root%\Python27\Lib\{username}
• %System Root%\Python27\Lib\calendar.pyc
• %System Root%\Python27\Lib\atexit.pyc.66to56856
• %System Root%\Python27\libs\_socket.lib.66to56856
• %System Root%\Python27\Lib\urllib.py.66to56856
• %System Root%\Python27\include\pyerrors.h.66to56856
• %System Root%\Python27\Lib\bsddb\dbshelve.py
• %System Root%\Python27\include\pyexpat.h.66to56856
• %System Root%\Python27\Lib\inspect.pyc
• %Desktop%\{username}
• %System Root%\Python27\Lib\bdb.py
• %System Root%\Python27\Lib\ctypes\util.py.66to56856
• A:\{username}
• %System Root%\Python27\Scripts\{username}
• %System Root%\Python27\Lib\ConfigParser.py
• %System Root%\Python27\Lib\_LWPCookieJar.pyc
• %System Root%\Python27\Lib\mimetypes.py
• %System Root%\Python27\Lib\msilib\{username}
• %System Root%\Python27\Lib\ctypes\wintypes.py
• %System Root%\Python27\Lib\fileinput.py.66to56856
• %System Root%\Python27\Lib\sre_constants.py.66to56856
• %System Root%\program files\{username}
• %System Root%\Python27\include\modsupport.h
• %System Root%\Python27\Lib\decimal.py
• %System Root%\Python27\Lib\tabnanny.py.66to56856
• %System Root%\Python27\Lib\uuid.pyc
• %System Root%\Python27\Lib\rfc822.pyc.66to56856
• %System Root%\Python27\Lib\commands.py
• %System Root%\Python27\Lib\tokenize.py.66to56856
• %System Root%\Python27\Lib\__future__.pyc.66to56856
• %System Root%\Python27\Lib\compiler\transformer.py.66to56856
• %System Root%\Python27\include\bytesobject.h
• %System Root%\Users\Default\NTUSER.DAT{{GUID}}.TM.blf.66to56856
• %System Root%\{username}
• %System Root%\Python27\Lib\Cookie.pyc
• %System Root%\Python27\Lib\base64.pyc
• %System Root%\Python27\include\pystrtod.h
• %User Profile%\{username}
• %System Root%\excel2k\XLS2KE03.xls
• %System Root%\powerpoint2k\PPT2KE01.ppt.66to56856
• %System Root%\Python27\include\moduleobject.h
• %System Root%\Python27\Lib\dumbdbm.py
• %System Root%\Python27\Lib\macpath.py.66to56856
• %System Root%\Python27\Lib\string.py
• %System Root%\Python27\Lib\bsddb\db.py
• %System Root%\Python27\Lib\xmlrpclib.pyc.66to56856
• %System Root%\Python27\Lib\functools.pyc
• %System Root%\Python27\Lib\random.pyc
• %System Root%\Python27\Lib\compiler\transformer.py
• %System Root%\word2k\DOC2KE04.doc
• %System Root%\Python27\Lib\posixfile.py
• %System Root%\Python27\Lib\asyncore.py.66to56856
• %System Root%\Python27\Lib\bdb.py.66to56856
• %System Root%\Email and Password List.js.66to56856
• %System Root%\Python27\include\dictobject.h.66to56856
• %System Root%\Python27\Lib\UserDict.py
• %System Root%\Python27\include\osdefs.h
• %System Root%\Python27\libs\libpython27.a.66to56856
• %System Root%\Python27\Lib\codecs.pyc
• %System Root%\Python27\Lib\getopt.pyc
• %System Root%\Python27\Lib\struct.py.66to56856
• %System Root%\Python27\Lib\inspect.py
• %System Root%\Python27\libs\select.lib
• %System Root%\Python27\Lib\os.pyc
• %System Root%\Python27\Lib\curses\panel.py
• %System Root%\Python27\Lib\ast.py.66to56856
• %System Root%\Python27\include\ast.h
• %System Root%\Python27\include\compile.h.66to56856
• %System Root%\Python27\Lib\poplib.py
• %System Root%\Python27\Lib\pickle.py
• %System Root%\Python27\Lib\markupbase.py
• %System Root%\Python27\Lib\filecmp.py
• %System Root%\Python27\include\pydebug.h.66to56856
• %System Root%\Python27\Lib\token.py
• %System Root%\Python27\NEWS.txt
• %System Root%\Python27\Lib\formatter.py
• %System Root%\Python27\Lib\sgmllib.py
• %System Root%\Python27\Lib\xmlrpclib.py
• %System Root%\Python27\Lib\cookielib.py.66to56856
• %System Root%\Python27\Lib\sysconfig.pyc
• %System Root%\Python27\Lib\distutils\{username}
• %System Root%\Python27\Lib\textwrap.pyc
• %System Root%\Python27\include\metagrammar.h.66to56856
• %System Root%\Python27\Lib\os.pyc.66to56856
• %System Root%\Python27\Lib\Bastion.py
• %System Root%\Recovery\{GUID}\{username}
• %System Root%\Python27\tcl\tix8.4.3\{username}
• %System Root%\powerpoint2k\PPT2KE05.ppt.66to56856
• %System Root%\Python27\Lib\bsddb\dbshelve.py.66to56856
• %System Root%\Python27\Lib\re.py.66to56856
• %User Profile%\ntuser.dat.LOG1
• %System Root%\Python27\Lib\SimpleXMLRPCServer.pyc.66to56856
• %System Root%\Python27\include\listobject.h.66to56856
• %System Root%\Python27\DLLs\_sqlite3.pyd.66to56856
• %System Root%\Python27\include\object.h
• %System Root%\Python27\DLLs\_msi.pyd.66to56856
• %System Root%\Python27\include\timefuncs.h
• %System Root%\excel2k\XLS2KE00.xlt.66to56856
• %System Root%\Python27\Lib\rlcompleter.py
• %System Root%\Python27\Lib\argparse.pyc
• %System Root%\Python27\Lib\toaiff.py
• %System Root%\Python27\Lib\keyword.py.66to56856
• %System Root%\Python27\Lib\bsddb\dbobj.py.66to56856
• %System Root%\Python27\Lib\pty.py.66to56856
• %System Root%\Python27\Lib\nntplib.py.66to56856
• %System Root%\Python27\include\Python.h
• %System Root%\Python27\Lib\compiler\{username}
• %User Profile%\NTUSER.DAT{{GUID}}.TMContainer00000000000000000001.regtrans-ms.66to56856
• %System Root%\Python27\Lib\wsgiref\{username}
• %System Root%\Python27\include\dtoa.h.66to56856
• %System Root%\Python27\Lib\stat.py.66to56856
• %System Root%\AVScanner.ini
• %System Root%\Python27\Lib\re.pyc
• %System Root%\Users\Default\Music\{username}
• %System Root%\Users\Default\NTUSER.DAT.LOG1
• %System Root%\Python27\Lib\dumbdbm.py.66to56856
• %System Root%\Python27\include\osdefs.h.66to56856
• %System Root%\Python27\Lib\SocketServer.pyc.66to56856
• %System Root%\Python27\Lib\posixpath.py
• %System Root%\word2k\DOC2KE02.doc
• %System Root%\Python27\Lib\cookielib.pyc.66to56856
• %System Root%\Python27\Lib\xml\{username}
• %System Root%\Python27\include\floatobject.h
• %System Root%\Python27\Lib\mutex.py.66to56856
• %System Root%\Python27\Lib\mimify.py.66to56856
• %System Root%\Python27\Lib\chunk.py.66to56856
• %System Root%\Python27\Lib\markupbase.pyc.66to56856
• %System Root%\Python27\Lib\UserString.py
• %System Root%\Python27\include\pythread.h.66to56856
• %System Root%\Python27\include\genobject.h
• %System Root%\Python27\Lib\ftplib.py.66to56856
• %System Root%\Python27\Lib\sets.py.66to56856
• %System Root%\Python27\Lib\difflib.py
• %User Profile%\Links\{username}
• %System Root%\Python27\libs\bz2.lib
• %System Root%\Python27\Lib\tokenize.pyc.66to56856
• %System Root%\Python27\include\py_curses.h
• %System Root%\Python27\README.txt.66to56856
• %System Root%\Python27\Lib\_osx_support.py.66to56856
• %System Root%\Python27\Lib\copy_reg.py.66to56856
• %System Root%\Python27\include\intrcheck.h.66to56856
• %System Root%\Python27\Lib\sunaudio.py.66to56856
• %System Root%\Python27\include\traceback.h
• %System Root%\Python27\include\pystate.h.66to56856
• %System Root%\Python27\tcl\tclstub85.lib
• %System Root%\Python27\include\pyerrors.h
• %System Root%\Python27\Lib\ntpath.pyc.66to56856
• %System Root%\Python27\Lib\sre_parse.py
• %System Root%\Users\Public\Desktop\{username}
• %System Root%\Python27\Lib\asynchat.py.66to56856
• %System Root%\Python27\Lib\urlparse.py.66to56856
• %System Root%\Python27\Lib\fnmatch.pyc.66to56856
• %System Root%\Python27\include\stringobject.h.66to56856
• %System Root%\Python27\include\pymactoolbox.h
• %System Root%\Python27\Lib\genericpath.py
• %System Root%\Python27\Tools\versioncheck\{username}
• %System Root%\Python27\Lib\cgi.py.66to56856
• %System Root%\Python27\Lib\profile.py.66to56856
• %System Root%\Python27\Lib\_abcoll.py
• %User Profile%\Videos\{username}
• %System Root%\Python27\Lib\doctest.py
• %System Root%\Python27\Lib\pipes.py.66to56856
• %User Profile%\NTUSER.DAT{{GUID}}.TMContainer00000000000000000001.regtrans-ms
• %System Root%\Python27\Lib\UserDict.py.66to56856
• %System Root%\Python27\Lib\Cookie.py.66to56856
• %System Root%\Users\Default\NTUSER.DAT{{GUID}}.TMContainer00000000000000000001.regtrans-ms.66to56856
• %System Root%\Python27\Lib\uuid.pyc.66to56856
• %System Root%\Recovery\{GUID}\Winre.wim.66to56856
• %System Root%\Python27\Lib\compiler\consts.py.66to56856
• %System Root%\Python27\Lib\compiler\ast.py.66to56856
• %System Root%\Python27\Lib\uu.pyc
• %System Root%\Python27\libs\_multiprocessing.lib.66to56856
• %System Root%\Python27\Lib\SimpleXMLRPCServer.py
• %System Root%\Python27\include\rangeobject.h.66to56856
• %System Root%\Python27\Lib\re.pyc.66to56856
• %System Root%\Python27\include\codecs.h.66to56856
• %System Root%\Python27\Lib\site.py
• %System Root%\Python27\include\bytes_methods.h.66to56856
• %User Profile%\Searches\{username}
• %System Root%\Python27\include\token.h
• %System Root%\Python27\Lib\mimetools.py.66to56856
• %System Root%\Python27\libs\winsound.lib.66to56856
• %System Root%\Python27\Lib\popen2.py
• %System Root%\Python27\Lib\SimpleXMLRPCServer.pyc
• %System Root%\Python27\Lib\compiler\pycodegen.py
• %System Root%\Python27\Lib\getopt.py
• %System Root%\Python27\Lib\curses\has_key.py.66to56856
• %System Root%\Python27\include\sliceobject.h
• %System Root%\Python27\DLLs\_hashlib.pyd
• %System Root%\Python27\include\floatobject.h.66to56856
• %System Root%\Recovery\{GUID}\boot.sdi.66to56856
• %System Root%\Python27\include\longintrepr.h.66to56856
• %System Root%\Python27\Lib\optparse.pyc
• %System Root%\Python27\include\compile.h
• %System Root%\Python27\Doc\python2715.chm
• %System Root%\Users\Default\downloads\{username}
• %System Root%\Python27\Lib\textwrap.pyc.66to56856
• %System Root%\Python27\Lib\telnetlib.py
• %System Root%\Users\Default\NTUSER.DAT.LOG1.66to56856
• %System Root%\Python27\Lib\ctypes\__init__.py.66to56856
• %System Root%\Python27\Lib\netrc.py.66to56856
• %System Root%\Python27\Lib\cmd.py.66to56856
• %System Root%\Python27\Lib\ntpath.py.66to56856
• %System Root%\Python27\Lib\cgi.pyc
• %System Root%\Python27\Lib\HTMLParser.py.66to56856
• %System Root%\Python27\include\fileobject.h
• %System Root%\Python27\Lib\UserList.py
• %System Root%\Python27\Lib\gettext.py.66to56856
• %System Root%\Python27\Lib\rfc822.py.66to56856
• %System Root%\powerpoint2k\PPT2KE04.ppt
• %System Root%\Python27\libs\_tkinter.lib
• %System Root%\Python27\Lib\pydoc_data\{username}
• %System Root%\Python27\libs\_ctypes.lib
• %System Root%\Python27\include\longobject.h.66to56856
• %System Root%\Python27\Lib\_strptime.py.66to56856
• %System Root%\Python27\Lib\fileinput.py
• %System Root%\Python27\include\{username}
• %System Root%\Python27\Lib\_osx_support.py
• %System Root%\Python27\libs\_tkinter.lib.66to56856
• %System Root%\Python27\include\setobject.h
• %System Root%\Python27\Lib\stat.pyc.66to56856
• %System Root%\Python27\Lib\tempfile.py.66to56856
• %System Root%\Python27\include\complexobject.h.66to56856
• %System Root%\Python27\Lib\heapq.py.66to56856
• %System Root%\Python27\Lib\__future__.pyc
• %System Root%\Python27\Lib\optparse.pyc.66to56856
• %System Root%\Python27\Lib\whichdb.py
• %System Root%\powerpoint2k\PPT2KE01.ppt
• %System Root%\Python27\include\stringobject.h
• %System Root%\Python27\tcl\tkstub85.lib
• %System Root%\Python27\Lib\copy_reg.py
• %System Root%\Python27\include\eval.h.66to56856
• %System Root%\Python27\include\dictobject.h
• %System Root%\Python27\include\marshal.h
• %System Root%\Python27\Lib\copy.pyc.66to56856
• %System Root%\Python27\Lib\imaplib.py
• %System Root%\Python27\include\metagrammar.h
• %System Root%\Python27\Lib\sre_constants.pyc.66to56856
• %System Root%\Python27\DLLs\unicodedata.pyd
• %System Root%\Python27\include\enumobject.h
• %System Root%\Python27\Lib\StringIO.py.66to56856
• %System Root%\Python27\Lib\poplib.py.66to56856
• %System Root%\Python27\Lib\idlelib\{username}
• %System Root%\Python27\include\pythread.h
• %System Root%\Users\Default\NTUSER.DAT{{GUID}}.TMContainer00000000000000000002.regtrans-ms.66to56856
• %System Root%\Python27\Lib\binhex.py
• %System Root%\Python27\Lib\DocXMLRPCServer.py
• %System Root%\Python27\Lib\pkgutil.py
• %System Root%\Python27\libs\_bsddb.lib.66to56856
• %System Root%\Python27\libs\_sqlite3.lib.66to56856
• %System Root%\Python27\Lib\copy_reg.pyc
• %System Root%\Python27\Lib\mhlib.py.66to56856
• %System Root%\Python27\Lib\_pyio.py
• %System Root%\Python27\Lib\threading.py
• %System Root%\Python27\Lib\urlparse.pyc.66to56856
• %System Root%\Python27\Lib\warnings.py.66to56856
• %System Root%\Python27\include\grammar.h.66to56856
• %System Root%\Python27\include\memoryobject.h.66to56856
• %System Root%\Python27\Lib\py_compile.pyc
• %System Root%\Python27\Lib\os2emxpath.py
• %User Profile%\Pictures\{username}
• %System Root%\Python27\Lib\base64.py
• %System Root%\Python27\Lib\sha.py
• %System Root%\Python27\Lib\bsddb\dbobj.py
• %System Root%\Python27\Lib\htmlentitydefs.py.66to56856
• %System Root%\Python27\Lib\gettext.pyc
• %System Root%\Python27\libs\_hashlib.lib.66to56856
• %System Root%\set_hostname.vbs
• %System Root%\Python27\DLLs\_testcapi.pyd
• %System Root%\Python27\Lib\textwrap.py
• %System Root%\Python27\Lib\mimetools.py
• %System Root%\Python27\Lib\symtable.py.66to56856
• %System Root%\Python27\include\Python-ast.h
• %System Root%\Python27\Lib\copy_reg.pyc.66to56856
• %System Root%\Users\Default\Desktop\{username}
• %System Root%\Python27\libs\_ctypes_test.lib.66to56856
• %System Root%\Python27\include\graminit.h.66to56856
• %System Root%\powerpoint2k\PPT2KE00.pot
• %System Root%\Python27\Lib\copy.pyc
• %System Root%\Users\Default\NTUSER.DAT{{GUID}}.TMContainer00000000000000000001.regtrans-ms
• %System Root%\Python27\Lib\anydbm.py
• %System Root%\Python27\Tools\i18n\{username}
• %System Root%\Python27\Lib\codecs.py
• %System Root%\Python27\Lib\sre_compile.py
• %System Root%\Python27\DLLs\unicodedata.pyd.66to56856
• %System Root%\Python27\Lib\smtplib.py.66to56856
• %System Root%\Python27\Lib\quopri.py
• %System Root%\Python27\Lib\curses\textpad.py.66to56856
• %System Root%\Python27\include\frameobject.h.66to56856
• %System Root%\Python27\include\pystrtod.h.66to56856
• %System Root%\Python27\Lib\curses\ascii.py
• %System Root%\Python27\Lib\mimetypes.pyc
• %System Root%\Python27\DLLs\pyexpat.pyd
• %System Root%\Python27\Lib\profile.py
• %System Root%\Python27\libs\_hashlib.lib
• %System Root%\Python27\Lib\dis.pyc
• %System Root%\Python27\Lib\md5.py
• %System Root%\Python27\include\pythonrun.h.66to56856
• %System Root%\Python27\libs\unicodedata.lib
• %System Root%\Python27\Lib\httplib.py
• %User Profile%\NTUSER.DAT{{GUID}}.TM.blf.66to56856
• %System Root%\Python27\Lib\glob.pyc.66to56856
• %System Root%\Python27\libs\_ctypes.lib.66to56856
• %System Root%\Python27\Lib\random.pyc.66to56856
• %System Root%\Python27\Lib\hotshot\{username}
• %System Root%\Python27\libs\_ssl.lib
• %System Root%\Python27\Lib\sre.py.66to56856
• %System Root%\powerpoint2k\PPT2KE05.ppt
• %System Root%\Python27\Lib\stat.pyc
• %System Root%\Python27\Lib\multifile.py
• %System Root%\Python27\Lib\xdrlib.py
• %System Root%\Python27\Lib\traceback.pyc
• %System Root%\Python27\Lib\linecache.pyc
• %System Root%\Python27\Lib\ctypes\macholib\{username}
• %System Root%\Python27\Lib\sets.py
• %System Root%\Python27\Lib\StringIO.pyc
• %System Root%\excel2k\XLS2KExx.xls.66to56856
• %System Root%\Python27\include\opcode.h
• %System Root%\Python27\Lib\decimal.pyc.66to56856
• %System Root%\Python27\Lib\tarfile.pyc.66to56856
• %System Root%\Python27\Lib\compileall.pyc.66to56856
• %System Root%\Python27\Lib\mhlib.py
• %System Root%\Users\Public\documents\{username}
• %System Root%\Python27\Lib\cookielib.py
• %System Root%\Python27\Lib\statvfs.py
• %System Root%\Python27\Lib\csv.py
• %System Root%\Python27\Lib\sunaudio.py
• %System Root%\Python27\Lib\shelve.py.66to56856
• %System Root%\Users\Default\documents\{username}
• %System Root%\Python27\include\sliceobject.h.66to56856
• %System Root%\Python27\Lib\rfc822.py
• %System Root%\Python27\Doc\python2715.chm.66to56856
• %System Root%\Python27\{username}
• %System Root%\Python27\include\enumobject.h.66to56856
• %System Root%\Python27\include\asdl.h
• %System Root%\Python27\Lib\new.py
• %System Root%\Python27\Lib\cgi.py
• %System Root%\Python27\Lib\tokenize.py
• %System Root%\Python27\Lib\sre.py
• %System Root%\Python27\Lib\xmlrpclib.pyc
• %System Root%\Python27\Lib\cProfile.py
• %System Root%\Python27\Lib\dircache.py.66to56856
• %System Root%\Python27\Lib\commands.py.66to56856
• %System Root%\Python27\Lib\webbrowser.py.66to56856
• %System Root%\Python27\Lib\platform.pyc
• %System Root%\Python27\include\datetime.h.66to56856
• %System Root%\Python27\LICENSE.txt.66to56856
• %System Root%\Python27\Lib\sre_constants.pyc
• %System Root%\Python27\Lib\tempfile.pyc.66to56856
• %System Root%\Python27\Lib\imputil.py.66to56856
• %System Root%\word2k\DOC2KE05.doc.66to56856
• %System Root%\Python27\Lib\locale.py.66to56856
• %System Root%\Python27\Lib\sched.py
• %System Root%\Python27\Lib\pdb.py.66to56856
• %Program Files%\{username}
• %System Root%\Python27\Lib\contextlib.pyc
• %System Root%\Python27\Lib\numbers.py
• %System Root%\excel2k\XLS2KE01.xls.66to56856
• %System Root%\powerpoint2k\{username}
• %System Root%\Python27\include\classobject.h
• %System Root%\Python27\Lib\Cookie.py
• %System Root%\Python27\include\pystate.h
• %System Root%\Python27\Lib\mailcap.py
• %System Root%\Python27\Lib\pprint.pyc
• %System Root%\Python27\Lib\token.pyc.66to56856
• %System Root%\Email and Password List.vbs
• %System Root%\Python27\Lib\symbol.py
• %System Root%\Python27\Lib\tarfile.pyc
• %System Root%\Python27\Lib\bsddb\dbtables.py.66to56856
• %System Root%\Python27\include\pymacconfig.h.66to56856
• %System Root%\Python27\Lib\linecache.py.66to56856
• %System Root%\Python27\Lib\glob.py
• %System Root%\Python27\Lib\mimetools.pyc.66to56856
• %System Root%\Python27\Lib\uu.py.66to56856
• %System Root%\Python27\Lib\quopri.pyc
• %System Root%\powerpoint2k\PPT2KE00.pot.66to56856
• %System Root%\excel2k\XLS2KE04.xls.66to56856
• %System Root%\Python27\Lib\shutil.pyc.66to56856
• %System Root%\Python27\libs\unicodedata.lib.66to56856
• %System Root%\Python27\Lib\MimeWriter.py.66to56856
• %System Root%\Python27\Lib\threading.pyc.66to56856
• %System Root%\Python27\Lib\StringIO.pyc.66to56856
• %System Root%\Python27\Lib\codecs.pyc.66to56856
• %System Root%\Python27\include\pyctype.h.66to56856
• %System Root%\Python27\libs\_socket.lib
• %System Root%\Python27\include\pymactoolbox.h.66to56856
• %System Root%\Python27\libs\_testcapi.lib
• %System Root%\Python27\Lib\compiler\visitor.py
• %System Root%\word2k\{username}
• %System Root%\Python27\Lib\gzip.py
• %System Root%\Python27\include\grammar.h
• %System Root%\Python27\Lib\code.py
• %System Root%\Python27\Lib\shlex.pyc.66to56856
• %System Root%\Python27\Lib\genericpath.py.66to56856
• %System Root%\Python27\DLLs\_ctypes_test.pyd
• %System Root%\Python27\Lib\dummy_thread.py.66to56856
• %System Root%\Python27\Lib\mailbox.py
• %System Root%\Python27\Lib\BaseHTTPServer.pyc.66to56856
• %System Root%\Python27\include\bitset.h.66to56856
• %System Root%\Python27\include\pycapsule.h.66to56856
• %System Root%\Python27\Lib\linecache.pyc.66to56856
• %System Root%\Python27\Lib\compiler\misc.py
• %System Root%\Python27\Lib\mimify.py
• %System Root%\Python27\Lib\SocketServer.py.66to56856
• %System Root%\Python27\Lib\dis.pyc.66to56856
• %System Root%\Users\Public\libraries\{username}
• %System Root%\excel2k\XLS2KE03.xls.66to56856
• %System Root%\Python27\Lib\calendar.pyc.66to56856
• %System Root%\Python27\Lib\tarfile.py.66to56856
• %System Root%\Python27\Lib\socket.py.66to56856
• %System Root%\Python27\Lib\HTMLParser.py
• %System Root%\Python27\Lib\htmlentitydefs.py
• %System Root%\Python27\include\warnings.h
• %System Root%\Python27\Lib\fractions.pyc
• %System Root%\Python27\Lib\opcode.pyc.66to56856
• %System Root%\Python27\Lib\bsddb\test\{username}
• %System Root%\Python27\tcl\tk85.lib.66to56856
• %System Root%\Python27\Lib\base64.pyc.66to56856
• %System Root%\Python27\Lib\codecs.py.66to56856
• %System Root%\Python27\Lib\xmllib.py
• %System Root%\Python27\Lib\socket.py
• %System Root%\Python27\Lib\filecmp.py.66to56856
• %System Root%\Python27\libs\_elementtree.lib.66to56856

(註：%System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.. %User Profile%フォルダは、現在ログオンしているユーザのプロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞" です。. %Favorites%フォルダは、現在ログオンしているユーザのお気に入りフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Favorites" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\Favorites" です。. %Desktop%フォルダは、現在ログオンしているユーザのデスクトップです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Desktop" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\Desktop" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。)

このウイルス情報は、自動解析システムにより作成されました。