解析者: Raighen Sanchez   
 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:
 情報漏えい:

  • マルウェアタイプ:
    トロイの木馬型

  • 破壊活動の有無:
    なし

  • 暗号化:
     

  • 感染報告の有無 :
    はい

  概要

感染経路 他のマルウェアからの作成, インターネットからのダウンロード

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 157801528 bytes
タイプ EXE
メモリ常駐 なし
発見日 2023年10月17日
ペイロード ファイルの作成, ファイルの作成

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のコンポーネントファイルを作成します。

  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-file-l2-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-handle-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-heap-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-interlocked-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-libraryloader-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-localization-l1-2-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-memory-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-namedpipe-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-processenvironment-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-processthreads-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-processthreads-l1-1-1.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-profile-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-rtlsupport-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-string-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-synch-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-synch-l1-2-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-sysinfo-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-timezone-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-util-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\API-MS-Win-core-xstate-l2-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-conio-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-convert-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-environment-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-filesystem-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-heap-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-locale-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-math-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-multibyte-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-private-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-process-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-runtime-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-stdio-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-string-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-time-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-utility-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\app.deps.json
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\app.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\app.runtimeconfig.json
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\clrcompression.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\clretwrc.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\clrjit.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\coreclr.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\D3DCompiler_47_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\dbgshim.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\DirectWriteForwarder.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\hostfxr.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\hostpolicy.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mi.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.CodeAnalysis.CSharp.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.CodeAnalysis.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.CSharp.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.DiaSymReader.Native.x86.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Management.Infrastructure.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Management.Infrastructure.Native.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Management.Infrastructure.Native.Unmanaged.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.VisualBasic.Core.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.VisualBasic.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Web.WebView2.Core.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Web.WebView2.WinForms.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Web.WebView2.Wpf.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.Registry.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.Registry.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.SystemEvents.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\miutils.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscordaccore.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscordaccore_x86_x86_4.700.22.55902.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscordbi.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscorlib.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscorrc.debug.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscorrc.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\netstandard.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Newtonsoft.Json.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PenImc_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationCore.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Aero.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Aero2.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.AeroLite.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Classic.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Luna.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Royale.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemCore.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemData.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemDrawing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemXml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemXmlLinq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationNative_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationUI.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ReachFramework.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\SOS_README.md
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.AppContext.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Buffers.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.CodeDom.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.Concurrent.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.Immutable.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.NonGeneric.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.Specialized.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.Annotations.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.DataAnnotations.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.EventBasedAsync.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.TypeConverter.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Configuration.ConfigurationManager.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Configuration.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Console.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Core.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Data.Common.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Data.DataSetExtensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Data.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Design.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Contracts.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Debug.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.DiagnosticSource.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.EventLog.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.FileVersionInfo.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.PerformanceCounter.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Process.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.StackTrace.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.TextWriterTraceListener.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Tools.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.TraceSource.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Tracing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.DirectoryServices.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.Common.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.Design.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Dynamic.Runtime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Globalization.Calendars.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Globalization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Globalization.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.Brotli.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.FileSystem.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.ZipFile.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.DriveInfo.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.Watcher.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.IsolatedStorage.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.MemoryMappedFiles.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Packaging.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Pipes.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Pipes.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.UnmanagedMemoryStream.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.Expressions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.Parallel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.Queryable.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Memory.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Http.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.HttpListener.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Mail.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.NameResolution.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.NetworkInformation.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Ping.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Requests.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Security.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.ServicePoint.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Sockets.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebClient.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebHeaderCollection.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebProxy.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebSockets.Client.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebSockets.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Numerics.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Numerics.Vectors.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ObjectModel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Printing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.CoreLib.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.DataContractSerialization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.Uri.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.Xml.Linq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.DispatchProxy.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Emit.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Emit.ILGeneration.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Emit.Lightweight.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Metadata.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.TypeExtensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.Reader.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.ResourceManager.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.Writer.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.CompilerServices.Unsafe.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.CompilerServices.VisualC.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Handles.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.InteropServices.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.InteropServices.RuntimeInformation.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.InteropServices.WindowsRuntime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Intrinsics.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Loader.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Numerics.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Formatters.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Json.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.WindowsRuntime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.WindowsRuntime.UI.Xaml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Claims.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Algorithms.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Cng.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Csp.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Encoding.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.OpenSsl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Pkcs.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.ProtectedData.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.X509Certificates.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Permissions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Principal.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Principal.Windows.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.SecureString.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ServiceModel.Web.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ServiceProcess.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encoding.CodePages.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encoding.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encoding.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encodings.Web.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Json.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.RegularExpressions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Channels.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Overlapped.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.Dataflow.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.Parallel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Thread.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.ThreadPool.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Timer.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Transactions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Transactions.Local.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ValueTuple.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Web.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Web.HttpUtility.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Controls.Ribbon.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Forms.Design.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Forms.Design.Editors.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Forms.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Input.Manipulations.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Presentation.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xaml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.Linq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.ReaderWriter.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.Serialization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XDocument.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XmlDocument.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XmlSerializer.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XPath.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XPath.XDocument.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ucrtbase.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationClient.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationClientSideProviders.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationProvider.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationTypes.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\vcruntime140_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\WebView2Loader.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\WindowsBase.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\WindowsFormsIntegration.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\wpfgfx_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\cs
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\de
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\es
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\fr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\it
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ja
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ko
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pl
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pt-BR
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ru
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\runtimes
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\tr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hans
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hant
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Accessibility.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-console-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-datetime-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-debug-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-errorhandling-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-file-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-file-l1-2-0.dll

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

マルウェアは、以下のフォルダを作成します。

  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ja
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ko
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pl
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pt-BR
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ru
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\runtimes
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\tr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hans
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hant
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\cs
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\de
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\es
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\fr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\it

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

  対応方法

対応検索エンジン: 9.800
初回 VSAPI パターンバージョン 18.748.52
初回 VSAPI パターンリリース日 2023年10月11日
VSAPI OPR パターンバージョン 18.749.00
VSAPI OPR パターンリリース日 2023年10月12日

手順 1

Windows 7、Windows 8、Windows 8.1、および Windows 10 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

このマルウェアもしくはアドウェア等の実行により、手順中に記載されたすべてのファイル、フォルダおよびレジストリキーや値がコンピュータにインストールされるとは限りません。インストールが不完全である場合の他、オペレーティングシステム（OS）の条件によりインストールがされない場合が考えられます。手順中に記載されたファイル／フォルダ／レジストリ情報が確認されない場合、該当の手順の操作は不要ですので、次の手順に進んでください。

手順 3

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。

  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ja
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ko
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pl
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pt-BR
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ru
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\runtimes
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\tr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hans
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hant
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\cs
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\de
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\es
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\fr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\it

手順 4

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。

  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-file-l2-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-handle-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-heap-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-interlocked-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-libraryloader-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-localization-l1-2-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-memory-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-namedpipe-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-processenvironment-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-processthreads-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-processthreads-l1-1-1.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-profile-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-rtlsupport-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-string-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-synch-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-synch-l1-2-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-sysinfo-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-timezone-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-util-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\API-MS-Win-core-xstate-l2-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-conio-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-convert-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-environment-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-filesystem-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-heap-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-locale-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-math-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-multibyte-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-private-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-process-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-runtime-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-stdio-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-string-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-time-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-crt-utility-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\app.deps.json
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\app.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\app.runtimeconfig.json
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\clrcompression.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\clretwrc.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\clrjit.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\coreclr.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\D3DCompiler_47_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\dbgshim.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\DirectWriteForwarder.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\hostfxr.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\hostpolicy.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mi.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.CodeAnalysis.CSharp.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.CodeAnalysis.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.CSharp.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.DiaSymReader.Native.x86.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Management.Infrastructure.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Management.Infrastructure.Native.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Management.Infrastructure.Native.Unmanaged.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.VisualBasic.Core.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.VisualBasic.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Web.WebView2.Core.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Web.WebView2.WinForms.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Web.WebView2.Wpf.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.Registry.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.Registry.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Microsoft.Win32.SystemEvents.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\miutils.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscordaccore.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscordaccore_x86_x86_4.700.22.55902.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscordbi.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscorlib.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscorrc.debug.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\mscorrc.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\netstandard.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Newtonsoft.Json.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PenImc_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationCore.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Aero.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Aero2.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.AeroLite.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Classic.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Luna.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework.Royale.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemCore.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemData.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemDrawing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemXml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationFramework-SystemXmlLinq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationNative_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\PresentationUI.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ReachFramework.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\SOS_README.md
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.AppContext.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Buffers.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.CodeDom.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.Concurrent.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.Immutable.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.NonGeneric.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Collections.Specialized.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.Annotations.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.DataAnnotations.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.EventBasedAsync.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ComponentModel.TypeConverter.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Configuration.ConfigurationManager.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Configuration.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Console.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Core.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Data.Common.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Data.DataSetExtensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Data.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Design.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Contracts.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Debug.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.DiagnosticSource.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.EventLog.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.FileVersionInfo.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.PerformanceCounter.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Process.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.StackTrace.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.TextWriterTraceListener.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Tools.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.TraceSource.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Diagnostics.Tracing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.DirectoryServices.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.Common.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.Design.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Drawing.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Dynamic.Runtime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Globalization.Calendars.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Globalization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Globalization.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.Brotli.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.FileSystem.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Compression.ZipFile.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.DriveInfo.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.FileSystem.Watcher.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.IsolatedStorage.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.MemoryMappedFiles.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Packaging.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Pipes.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.Pipes.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.IO.UnmanagedMemoryStream.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.Expressions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.Parallel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Linq.Queryable.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Memory.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Http.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.HttpListener.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Mail.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.NameResolution.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.NetworkInformation.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Ping.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Requests.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Security.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.ServicePoint.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.Sockets.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebClient.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebHeaderCollection.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebProxy.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebSockets.Client.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Net.WebSockets.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Numerics.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Numerics.Vectors.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ObjectModel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Printing.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.CoreLib.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.DataContractSerialization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.Uri.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Private.Xml.Linq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.DispatchProxy.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Emit.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Emit.ILGeneration.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Emit.Lightweight.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Metadata.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Reflection.TypeExtensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.Reader.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.ResourceManager.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Resources.Writer.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.CompilerServices.Unsafe.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.CompilerServices.VisualC.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Handles.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.InteropServices.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.InteropServices.RuntimeInformation.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.InteropServices.WindowsRuntime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Intrinsics.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Loader.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Numerics.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Formatters.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Json.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.Serialization.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.WindowsRuntime.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Runtime.WindowsRuntime.UI.Xaml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Claims.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Algorithms.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Cng.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Csp.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Encoding.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.OpenSsl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Pkcs.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Primitives.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.ProtectedData.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.X509Certificates.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Cryptography.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Permissions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Principal.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.Principal.Windows.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Security.SecureString.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ServiceModel.Web.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ServiceProcess.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encoding.CodePages.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encoding.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encoding.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Encodings.Web.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.Json.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Text.RegularExpressions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.AccessControl.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Channels.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Overlapped.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.Dataflow.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Tasks.Parallel.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Thread.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.ThreadPool.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Threading.Timer.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Transactions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Transactions.Local.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.ValueTuple.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Web.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Web.HttpUtility.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Controls.Ribbon.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Extensions.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Forms.Design.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Forms.Design.Editors.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Forms.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Input.Manipulations.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Windows.Presentation.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xaml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.Linq.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.ReaderWriter.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.Serialization.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XDocument.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XmlDocument.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XmlSerializer.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XPath.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\System.Xml.XPath.XDocument.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ucrtbase.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationClient.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationClientSideProviders.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationProvider.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\UIAutomationTypes.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\vcruntime140_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\WebView2Loader.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\WindowsBase.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\WindowsFormsIntegration.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\wpfgfx_cor3.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\cs
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\de
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\es
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\fr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\it
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ja
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ko
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pl
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\pt-BR
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\ru
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\runtimes
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\tr
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hans
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\zh-Hant
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\Accessibility.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-console-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-datetime-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-debug-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-errorhandling-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-file-l1-1-0.dll
  • %User Temp%\.net\{malware filename}\x8_Gc9l9B8qb3EtiMo9OGUAeLPKwQxs=\api-ms-win-core-file-l1-2-0.dll

手順 5

最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「Trojan.Win32.REDLINE.ENZ」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。


ご利用はいかがでしたか？　アンケートにご協力ください