Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\_mei5882\pil\_imaging.cp37-win32.pyd
- %TEMP%\_mei5882\tcl\tzdata\australia\eucla
- %TEMP%\_mei5882\tcl\tzdata\australia\hobart
- %TEMP%\_mei5882\tcl\tzdata\australia\lhi
- %TEMP%\_mei5882\tcl\tzdata\australia\lindeman
- %TEMP%\_mei5882\tcl\tzdata\australia\lord_howe
- %TEMP%\_mei5882\tcl\tzdata\australia\melbourne
- %TEMP%\_mei5882\tcl\tzdata\australia\nsw
- %TEMP%\_mei5882\tcl\tzdata\australia\north
- %TEMP%\_mei5882\tcl\tzdata\australia\perth
- %TEMP%\_mei5882\tcl\tzdata\australia\queensland
- %TEMP%\_mei5882\tcl\tzdata\australia\south
- %TEMP%\_mei5882\tcl\tzdata\australia\sydney
- %TEMP%\_mei5882\tcl\tzdata\australia\currie
- %TEMP%\_mei5882\tcl\tzdata\australia\darwin
- %TEMP%\_mei5882\tcl\tzdata\australia\tasmania
- %TEMP%\_mei5882\tcl\tzdata\australia\yancowinna
- %TEMP%\_mei5882\tcl\tzdata\brazil\acre
- %TEMP%\_mei5882\tcl\tzdata\brazil\denoronha
- %TEMP%\_mei5882\tcl\tzdata\brazil\east
- %TEMP%\_mei5882\tcl\tzdata\brazil\west
- %TEMP%\_mei5882\tcl\tzdata\cet
- %TEMP%\_mei5882\tcl\tzdata\cst6cdt
- %TEMP%\_mei5882\tcl\tzdata\canada\atlantic
- %TEMP%\_mei5882\tcl\tzdata\canada\central
- %TEMP%\_mei5882\tcl\tzdata\canada\east-saskatchewan
- %TEMP%\_mei5882\tcl\tzdata\canada\eastern
- %TEMP%\_mei5882\tcl\tzdata\canada\mountain
- %TEMP%\_mei5882\tcl\tzdata\australia\victoria
- %TEMP%\_mei5882\tcl\tzdata\australia\west
- %TEMP%\_mei5882\tcl\tzdata\australia\canberra
- %TEMP%\_mei5882\tcl\tzdata\australia\broken_hill
- %TEMP%\_mei5882\tcl\tzdata\australia\brisbane
- %TEMP%\_mei5882\tcl\tzdata\asia\thimphu
- %TEMP%\_mei5882\tcl\tzdata\asia\tokyo
- %TEMP%\_mei5882\tcl\tzdata\asia\tomsk
- %TEMP%\_mei5882\tcl\tzdata\asia\ujung_pandang
- %TEMP%\_mei5882\tcl\tzdata\asia\ulaanbaatar
- %TEMP%\_mei5882\tcl\tzdata\asia\ulan_bator
- %TEMP%\_mei5882\tcl\tzdata\asia\urumqi
- %TEMP%\_mei5882\tcl\tzdata\asia\ust-nera
- %TEMP%\_mei5882\tcl\tzdata\asia\vientiane
- %TEMP%\_mei5882\tcl\tzdata\asia\vladivostok
- %TEMP%\_mei5882\tcl\tzdata\asia\yakutsk
- %TEMP%\_mei5882\tcl\tzdata\asia\yangon
- %TEMP%\_mei5882\tcl\tzdata\asia\yekaterinburg
- %TEMP%\_mei5882\tcl\tzdata\asia\thimbu
- %TEMP%\_mei5882\tcl\tzdata\asia\yerevan
- %TEMP%\_mei5882\tcl\tzdata\atlantic\bermuda
- %TEMP%\_mei5882\tcl\tzdata\atlantic\canary
- %TEMP%\_mei5882\tcl\tzdata\atlantic\cape_verde
- %TEMP%\_mei5882\tcl\tzdata\atlantic\faeroe
- %TEMP%\_mei5882\tcl\tzdata\atlantic\faroe
- %TEMP%\_mei5882\tcl\tzdata\atlantic\jan_mayen
- %TEMP%\_mei5882\tcl\tzdata\atlantic\madeira
- %TEMP%\_mei5882\tcl\tzdata\atlantic\reykjavik
- %TEMP%\_mei5882\tcl\tzdata\atlantic\south_georgia
- %TEMP%\_mei5882\tcl\tzdata\atlantic\st_helena
- %TEMP%\_mei5882\tcl\tzdata\atlantic\stanley
- %TEMP%\_mei5882\tcl\tzdata\australia\act
- %TEMP%\_mei5882\tcl\tzdata\australia\adelaide
- %TEMP%\_mei5882\tcl\tzdata\atlantic\azores
- %TEMP%\_mei5882\tcl\tzdata\canada\newfoundland
- %TEMP%\_mei5882\tcl\tzdata\canada\saskatchewan
- %TEMP%\_mei5882\tcl\tzdata\europe\isle_of_man
- %TEMP%\_mei5882\tcl\tzdata\canada\yukon
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-7
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-8
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-9
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt0
- %TEMP%\_mei5882\tcl\tzdata\etc\greenwich
- %TEMP%\_mei5882\tcl\tzdata\etc\uct
- %TEMP%\_mei5882\tcl\tzdata\etc\utc
- %TEMP%\_mei5882\tcl\tzdata\etc\universal
- %TEMP%\_mei5882\tcl\tzdata\etc\zulu
- %TEMP%\_mei5882\tcl\tzdata\europe\amsterdam
- %TEMP%\_mei5882\tcl\tzdata\europe\andorra
- %TEMP%\_mei5882\tcl\tzdata\europe\astrakhan
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-5
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-6
- %TEMP%\_mei5882\tcl\tzdata\europe\athens
- %TEMP%\_mei5882\tcl\tzdata\europe\berlin
- %TEMP%\_mei5882\tcl\tzdata\europe\bratislava
- %TEMP%\_mei5882\tcl\tzdata\europe\brussels
- %TEMP%\_mei5882\tcl\tzdata\europe\bucharest
- %TEMP%\_mei5882\tcl\tzdata\europe\budapest
- %TEMP%\_mei5882\tcl\tzdata\europe\busingen
- %TEMP%\_mei5882\tcl\tzdata\europe\chisinau
- %TEMP%\_mei5882\tcl\tzdata\europe\copenhagen
- %TEMP%\_mei5882\tcl\tzdata\europe\dublin
- %TEMP%\_mei5882\tcl\tzdata\europe\gibraltar
- %TEMP%\_mei5882\tcl\tzdata\europe\guernsey
- %TEMP%\_mei5882\tcl\tzdata\europe\helsinki
- %TEMP%\_mei5882\tcl\tzdata\europe\belfast
- %TEMP%\_mei5882\tcl\tzdata\europe\belgrade
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-4
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-3
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-2
- %TEMP%\_mei5882\tcl\tzdata\chile\easterisland
- %TEMP%\_mei5882\tcl\tzdata\cuba
- %TEMP%\_mei5882\tcl\tzdata\eet
- %TEMP%\_mei5882\tcl\tzdata\est
- %TEMP%\_mei5882\tcl\tzdata\est5edt
- %TEMP%\_mei5882\tcl\tzdata\egypt
- %TEMP%\_mei5882\tcl\tzdata\eire
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+0
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+1
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+10
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+11
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+12
- %TEMP%\_mei5882\tcl\tzdata\chile\continental
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+2
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+4
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+5
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+6
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+7
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+8
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+9
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-0
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-1
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-10
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-11
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-12
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-13
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt-14
- %TEMP%\_mei5882\tcl\tzdata\etc\gmt+3
- %TEMP%\_mei5882\tcl\tzdata\asia\tel_aviv
- %TEMP%\_mei5882\tcl\tzdata\canada\pacific
- %TEMP%\_mei5882\tcl\tzdata\asia\tehran
- %TEMP%\_mei5882\tcl\tzdata\asia\bishkek
- %TEMP%\_mei5882\tcl\tzdata\antarctica\casey
- %TEMP%\_mei5882\tcl\tzdata\antarctica\davis
- %TEMP%\_mei5882\tcl\tzdata\antarctica\dumontdurville
- %TEMP%\_mei5882\tcl\tzdata\antarctica\macquarie
- %TEMP%\_mei5882\tcl\tzdata\antarctica\mawson
- %TEMP%\_mei5882\tcl\tzdata\antarctica\mcmurdo
- %TEMP%\_mei5882\tcl\tzdata\antarctica\palmer
- %TEMP%\_mei5882\tcl\tzdata\antarctica\rothera
- %TEMP%\_mei5882\tcl\tzdata\antarctica\south_pole
- %TEMP%\_mei5882\tcl\tzdata\antarctica\syowa
- %TEMP%\_mei5882\tcl\tzdata\antarctica\troll
- %TEMP%\_mei5882\tcl\tzdata\antarctica\vostok
- %TEMP%\_mei5882\tcl\tzdata\america\yakutat
- %TEMP%\_mei5882\tcl\tzdata\america\yellowknife
- %TEMP%\_mei5882\tcl\tzdata\arctic\longyearbyen
- %TEMP%\_mei5882\tcl\tzdata\asia\amman
- %TEMP%\_mei5882\tcl\tzdata\asia\anadyr
- %TEMP%\_mei5882\tcl\tzdata\asia\aqtau
- %TEMP%\_mei5882\tcl\tzdata\asia\aqtobe
- %TEMP%\_mei5882\tcl\tzdata\asia\ashgabat
- %TEMP%\_mei5882\tcl\tzdata\asia\ashkhabad
- %TEMP%\_mei5882\tcl\tzdata\asia\atyrau
- %TEMP%\_mei5882\tcl\tzdata\asia\baghdad
- %TEMP%\_mei5882\tcl\tzdata\asia\bahrain
- %TEMP%\_mei5882\tcl\tzdata\asia\baku
- %TEMP%\_mei5882\tcl\tzdata\asia\bangkok
- %TEMP%\_mei5882\tcl\tzdata\asia\barnaul
- %TEMP%\_mei5882\tcl\tzdata\asia\aden
- %TEMP%\_mei5882\tcl\tzdata\asia\almaty
- %TEMP%\_mei5882\tcl\tzdata\america\winnipeg
- %TEMP%\_mei5882\tcl\tzdata\america\whitehorse
- %TEMP%\_mei5882\tcl\tzdata\america\virgin
- %TEMP%\_mei5882\tcl\tzdata\america\rankin_inlet
- %TEMP%\_mei5882\tcl\tzdata\america\recife
- %TEMP%\_mei5882\tcl\tzdata\america\regina
- %TEMP%\_mei5882\tcl\tzdata\america\resolute
- %TEMP%\_mei5882\tcl\tzdata\america\rio_branco
- %TEMP%\_mei5882\tcl\tzdata\america\rosario
- %TEMP%\_mei5882\tcl\tzdata\america\santa_isabel
- %TEMP%\_mei5882\tcl\tzdata\america\santarem
- %TEMP%\_mei5882\tcl\tzdata\america\santiago
- %TEMP%\_mei5882\tcl\tzdata\america\santo_domingo
- %TEMP%\_mei5882\tcl\tzdata\america\sao_paulo
- %TEMP%\_mei5882\tcl\tzdata\america\scoresbysund
- %TEMP%\_mei5882\tcl\tzdata\america\shiprock
- %TEMP%\_mei5882\tcl\tzdata\america\rainy_river
- %TEMP%\_mei5882\tcl\tzdata\america\sitka
- %TEMP%\_mei5882\tcl\tzdata\america\st_johns
- %TEMP%\_mei5882\tcl\tzdata\america\st_kitts
- %TEMP%\_mei5882\tcl\tzdata\america\st_lucia
- %TEMP%\_mei5882\tcl\tzdata\america\st_thomas
- %TEMP%\_mei5882\tcl\tzdata\america\st_vincent
- %TEMP%\_mei5882\tcl\tzdata\america\swift_current
- %TEMP%\_mei5882\tcl\tzdata\america\tegucigalpa
- %TEMP%\_mei5882\tcl\tzdata\america\thule
- %TEMP%\_mei5882\tcl\tzdata\america\thunder_bay
- %TEMP%\_mei5882\tcl\tzdata\america\tijuana
- %TEMP%\_mei5882\tcl\tzdata\america\toronto
- %TEMP%\_mei5882\tcl\tzdata\america\tortola
- %TEMP%\_mei5882\tcl\tzdata\america\vancouver
- %TEMP%\_mei5882\tcl\tzdata\america\st_barthelemy
- %TEMP%\_mei5882\tcl\tzdata\asia\beirut
- %TEMP%\_mei5882\tcl\tzdata\asia\brunei
- %TEMP%\_mei5882\tcl\tzdata\asia\tashkent
- %TEMP%\_mei5882\tcl\tzdata\asia\calcutta
- %TEMP%\_mei5882\tcl\tzdata\asia\kuwait
- %TEMP%\_mei5882\tcl\tzdata\asia\macao
- %TEMP%\_mei5882\tcl\tzdata\asia\macau
- %TEMP%\_mei5882\tcl\tzdata\asia\magadan
- %TEMP%\_mei5882\tcl\tzdata\asia\makassar
- %TEMP%\_mei5882\tcl\tzdata\asia\manila
- %TEMP%\_mei5882\tcl\tzdata\asia\muscat
- %TEMP%\_mei5882\tcl\tzdata\asia\nicosia
- %TEMP%\_mei5882\tcl\tzdata\asia\novokuznetsk
- %TEMP%\_mei5882\tcl\tzdata\asia\novosibirsk
- %TEMP%\_mei5882\tcl\tzdata\asia\omsk
- %TEMP%\_mei5882\tcl\tzdata\asia\oral
- %TEMP%\_mei5882\tcl\tzdata\asia\kuala_lumpur
- %TEMP%\_mei5882\tcl\tzdata\asia\kuching
- %TEMP%\_mei5882\tcl\tzdata\asia\phnom_penh
- %TEMP%\_mei5882\tcl\tzdata\asia\qatar
- %TEMP%\_mei5882\tcl\tzdata\asia\qyzylorda
- %TEMP%\_mei5882\tcl\tzdata\asia\rangoon
- %TEMP%\_mei5882\tcl\tzdata\asia\riyadh
- %TEMP%\_mei5882\tcl\tzdata\asia\saigon
- %TEMP%\_mei5882\tcl\tzdata\asia\sakhalin
- %TEMP%\_mei5882\tcl\tzdata\asia\samarkand
- %TEMP%\_mei5882\tcl\tzdata\asia\seoul
- %TEMP%\_mei5882\tcl\tzdata\asia\shanghai
- %TEMP%\_mei5882\tcl\tzdata\asia\singapore
- %TEMP%\_mei5882\tcl\tzdata\asia\srednekolymsk
- %TEMP%\_mei5882\tcl\tzdata\asia\taipei
- %TEMP%\_mei5882\tcl\tzdata\asia\pontianak
- %TEMP%\_mei5882\tcl\tzdata\asia\pyongyang
- %TEMP%\_mei5882\tcl\tzdata\asia\krasnoyarsk
- %TEMP%\_mei5882\tcl\tzdata\asia\kolkata
- %TEMP%\_mei5882\tcl\tzdata\asia\khandyga
- %TEMP%\_mei5882\tcl\tzdata\asia\choibalsan
- %TEMP%\_mei5882\tcl\tzdata\asia\chongqing
- %TEMP%\_mei5882\tcl\tzdata\asia\chungking
- %TEMP%\_mei5882\tcl\tzdata\asia\colombo
- %TEMP%\_mei5882\tcl\tzdata\asia\dacca
- %TEMP%\_mei5882\tcl\tzdata\asia\damascus
- %TEMP%\_mei5882\tcl\tzdata\asia\dhaka
- %TEMP%\_mei5882\tcl\tzdata\asia\dili
- %TEMP%\_mei5882\tcl\tzdata\asia\dubai
- %TEMP%\_mei5882\tcl\tzdata\asia\dushanbe
- %TEMP%\_mei5882\tcl\tzdata\asia\famagusta
- %TEMP%\_mei5882\tcl\tzdata\asia\gaza
- %TEMP%\_mei5882\tcl\tzdata\asia\harbin
- %TEMP%\_mei5882\tcl\tzdata\asia\chita
- %TEMP%\_mei5882\tcl\tzdata\asia\hebron
- %TEMP%\_mei5882\tcl\tzdata\asia\hong_kong
- %TEMP%\_mei5882\tcl\tzdata\asia\hovd
- %TEMP%\_mei5882\tcl\tzdata\asia\irkutsk
- %TEMP%\_mei5882\tcl\tzdata\asia\istanbul
- %TEMP%\_mei5882\tcl\tzdata\asia\jakarta
- %TEMP%\_mei5882\tcl\tzdata\asia\jayapura
- %TEMP%\_mei5882\tcl\tzdata\asia\jerusalem
- %TEMP%\_mei5882\tcl\tzdata\asia\kabul
- %TEMP%\_mei5882\tcl\tzdata\asia\kamchatka
- %TEMP%\_mei5882\tcl\tzdata\asia\karachi
- %TEMP%\_mei5882\tcl\tzdata\asia\kashgar
- %TEMP%\_mei5882\tcl\tzdata\asia\kathmandu
- %TEMP%\_mei5882\tcl\tzdata\asia\katmandu
- %TEMP%\_mei5882\tcl\tzdata\asia\ho_chi_minh
- %TEMP%\_mei5882\tcl\tzdata\asia\tbilisi
- %TEMP%\_mei5882\tcl\tzdata\israel
- %TEMP%\tmpl3n19occ\gen_py\dicts.dat
- %TEMP%\_mei5882\tcl\tzdata\europe\kaliningrad
- %TEMP%\_mei5882\tk\clrpick.tcl
- %TEMP%\_mei5882\tk\comdlg.tcl
- %TEMP%\_mei5882\tk\console.tcl
- %TEMP%\_mei5882\tk\dialog.tcl
- %TEMP%\_mei5882\tk\entry.tcl
- %TEMP%\_mei5882\tk\focus.tcl
- %TEMP%\_mei5882\tk\fontchooser.tcl
- %TEMP%\_mei5882\tk\iconlist.tcl
- %TEMP%\_mei5882\tk\icons.tcl
- %TEMP%\_mei5882\tk\images\readme
- %TEMP%\_mei5882\tk\images\logo.eps
- %TEMP%\_mei5882\tk\images\logo100.gif
- %TEMP%\_mei5882\tk\button.tcl
- %TEMP%\_mei5882\tk\choosedir.tcl
- %TEMP%\_mei5882\tk\images\logo64.gif
- %TEMP%\_mei5882\tk\images\pwrdlogo.eps
- %TEMP%\_mei5882\tk\images\pwrdlogo100.gif
- %TEMP%\_mei5882\tk\images\pwrdlogo150.gif
- %TEMP%\_mei5882\tk\images\pwrdlogo175.gif
- %TEMP%\_mei5882\tk\images\pwrdlogo200.gif
- %TEMP%\_mei5882\tk\images\pwrdlogo75.gif
- %TEMP%\_mei5882\tk\images\tai-ku.gif
- %TEMP%\_mei5882\tk\license.terms
- %TEMP%\_mei5882\tk\listbox.tcl
- %TEMP%\_mei5882\tk\megawidget.tcl
- %TEMP%\_mei5882\tk\menu.tcl
- %TEMP%\_mei5882\tk\mkpsenc.tcl
- %TEMP%\_mei5882\tk\images\logolarge.gif
- %TEMP%\_mei5882\tk\images\logomed.gif
- %TEMP%\_mei5882\tk\bgerror.tcl
- %TEMP%\_mei5882\tcl\word.tcl
- %TEMP%\_mei5882\tcl\tzdata\zulu
- %TEMP%\_mei5882\tcl\tzdata\systemv\est5
- %TEMP%\_mei5882\tcl\tzdata\systemv\est5edt
- %TEMP%\_mei5882\tcl\tzdata\systemv\hst10
- %TEMP%\_mei5882\tcl\tzdata\systemv\mst7
- %TEMP%\_mei5882\tcl\tzdata\systemv\mst7mdt
- %TEMP%\_mei5882\tcl\tzdata\systemv\pst8
- %TEMP%\_mei5882\tcl\tzdata\systemv\pst8pdt
- %TEMP%\_mei5882\tcl\tzdata\systemv\yst9
- %TEMP%\_mei5882\tcl\tzdata\systemv\yst9ydt
- %TEMP%\_mei5882\tcl\tzdata\turkey
- %TEMP%\_mei5882\tcl\tzdata\uct
- %TEMP%\_mei5882\tcl\tzdata\us\alaska
- %TEMP%\_mei5882\tcl\tzdata\us\aleutian
- %TEMP%\_mei5882\tcl\tzdata\systemv\cst6cdt
- %TEMP%\_mei5882\tcl\tzdata\us\arizona
- %TEMP%\_mei5882\tcl\tzdata\us\east-indiana
- %TEMP%\_mei5882\tcl\tzdata\us\eastern
- %TEMP%\_mei5882\tcl\tzdata\us\hawaii
- %TEMP%\_mei5882\tcl\tzdata\us\indiana-starke
- %TEMP%\_mei5882\tcl\tzdata\us\michigan
- %TEMP%\_mei5882\tcl\tzdata\us\mountain
- %TEMP%\_mei5882\tcl\tzdata\us\pacific
- %TEMP%\_mei5882\tcl\tzdata\us\pacific-new
- %TEMP%\_mei5882\tcl\tzdata\us\samoa
- %TEMP%\_mei5882\tcl\tzdata\utc
- %TEMP%\_mei5882\tcl\tzdata\universal
- %TEMP%\_mei5882\tcl\tzdata\w-su
- %TEMP%\_mei5882\tcl\tzdata\wet
- %TEMP%\_mei5882\tcl\tzdata\us\central
- %TEMP%\_mei5882\tk\msgbox.tcl
- %TEMP%\_mei5882\tk\msgs\da.msg
- %TEMP%\_mei5882\tcl\tzdata\europe\jersey
- %TEMP%\_mei5882\tk\msgs\de.msg
- %TEMP%\_mei5882\tk\ttk\defaults.tcl
- %TEMP%\_mei5882\tk\ttk\entry.tcl
- %TEMP%\_mei5882\tk\ttk\fonts.tcl
- %TEMP%\_mei5882\tk\ttk\menubutton.tcl
- %TEMP%\_mei5882\tk\ttk\notebook.tcl
- %TEMP%\_mei5882\tk\ttk\panedwindow.tcl
- %TEMP%\_mei5882\tk\ttk\progress.tcl
- %TEMP%\_mei5882\tk\ttk\scale.tcl
- %TEMP%\_mei5882\tk\ttk\scrollbar.tcl
- %TEMP%\_mei5882\tk\ttk\sizegrip.tcl
- %TEMP%\_mei5882\tk\ttk\spinbox.tcl
- %TEMP%\_mei5882\tk\ttk\treeview.tcl
- %TEMP%\_mei5882\tk\ttk\combobox.tcl
- %TEMP%\_mei5882\tk\ttk\cursors.tcl
- %TEMP%\_mei5882\tk\ttk\ttk.tcl
- %TEMP%\_mei5882\tk\ttk\wintheme.tcl
- %TEMP%\_mei5882\tk\ttk\xptheme.tcl
- %TEMP%\_mei5882\tk\unsupported.tcl
- %TEMP%\_mei5882\tk\xmfbox.tcl
- %TEMP%\_mei5882\wheel-0.42.0.dist-info\installer
- %TEMP%\_mei5882\wheel-0.42.0.dist-info\license.txt
- %TEMP%\_mei5882\wheel-0.42.0.dist-info\metadata
- %TEMP%\_mei5882\wheel-0.42.0.dist-info\record
- %TEMP%\_mei5882\wheel-0.42.0.dist-info\wheel
- %TEMP%\_mei5882\wheel-0.42.0.dist-info\entry_points.txt
- %TEMP%\nqyyjb10
- %TEMP%\tmpl3n19occ\gen_py\__init__.py
- %TEMP%\_mei5882\tk\ttk\utils.tcl
- %TEMP%\_mei5882\tk\ttk\vistatheme.tcl
- %TEMP%\_mei5882\tk\ttk\classictheme.tcl
- %TEMP%\_mei5882\tk\ttk\clamtheme.tcl
- %TEMP%\_mei5882\tk\ttk\button.tcl
- %TEMP%\_mei5882\tk\msgs\en.msg
- %TEMP%\_mei5882\tk\msgs\en_gb.msg
- %TEMP%\_mei5882\tk\msgs\eo.msg
- %TEMP%\_mei5882\tk\msgs\es.msg
- %TEMP%\_mei5882\tk\msgs\fr.msg
- %TEMP%\_mei5882\tk\msgs\hu.msg
- %TEMP%\_mei5882\tk\msgs\it.msg
- %TEMP%\_mei5882\tk\msgs\nl.msg
- %TEMP%\_mei5882\tk\msgs\pl.msg
- %TEMP%\_mei5882\tk\msgs\pt.msg
- %TEMP%\_mei5882\tk\msgs\ru.msg
- %TEMP%\_mei5882\tk\msgs\sv.msg
- %TEMP%\_mei5882\tk\obsolete.tcl
- %TEMP%\_mei5882\tk\msgs\el.msg
- %TEMP%\_mei5882\tk\optmenu.tcl
- %TEMP%\_mei5882\tk\panedwindow.tcl
- %TEMP%\_mei5882\tk\pkgindex.tcl
- %TEMP%\_mei5882\tk\safetk.tcl
- %TEMP%\_mei5882\tk\scale.tcl
- %TEMP%\_mei5882\tk\scrlbar.tcl
- %TEMP%\_mei5882\tk\spinbox.tcl
- %TEMP%\_mei5882\tk\tclindex
- %TEMP%\_mei5882\tk\tearoff.tcl
- %TEMP%\_mei5882\tk\text.tcl
- %TEMP%\_mei5882\tk\tk.tcl
- %TEMP%\_mei5882\tk\tkfbox.tcl
- %TEMP%\_mei5882\tk\ttk\alttheme.tcl
- %TEMP%\_mei5882\tk\ttk\aquatheme.tcl
- %TEMP%\_mei5882\tk\palette.tcl
- %TEMP%\_mei5882\tcl\tzdata\systemv\cst6
- %TEMP%\_mei5882\tcl\tzdata\america\punta_arenas
- %TEMP%\_mei5882\tcl\tzdata\systemv\ast4adt
- %TEMP%\_mei5882\tcl\tzdata\iran
- %TEMP%\_mei5882\tcl\tzdata\europe\vienna
- %TEMP%\_mei5882\tcl\tzdata\europe\vilnius
- %TEMP%\_mei5882\tcl\tzdata\europe\volgograd
- %TEMP%\_mei5882\tcl\tzdata\europe\warsaw
- %TEMP%\_mei5882\tcl\tzdata\europe\zagreb
- %TEMP%\_mei5882\tcl\tzdata\europe\zaporozhye
- %TEMP%\_mei5882\tcl\tzdata\europe\zurich
- %TEMP%\_mei5882\tcl\tzdata\gb
- %TEMP%\_mei5882\tcl\tzdata\gb-eire
- %TEMP%\_mei5882\tcl\tzdata\gmt
- %TEMP%\_mei5882\tcl\tzdata\gmt+0
- %TEMP%\_mei5882\tcl\tzdata\gmt-0
- %TEMP%\_mei5882\tcl\tzdata\europe\vaduz
- %TEMP%\_mei5882\tcl\tzdata\europe\vatican
- %TEMP%\_mei5882\tcl\tzdata\gmt0
- %TEMP%\_mei5882\tcl\tzdata\hongkong
- %TEMP%\_mei5882\tcl\tzdata\iceland
- %TEMP%\_mei5882\tcl\tzdata\indian\antananarivo
- %TEMP%\_mei5882\tcl\tzdata\indian\chagos
- %TEMP%\_mei5882\tcl\tzdata\indian\christmas
- %TEMP%\_mei5882\tcl\tzdata\indian\cocos
- %TEMP%\_mei5882\tcl\tzdata\indian\comoro
- %TEMP%\_mei5882\tcl\tzdata\indian\kerguelen
- %TEMP%\_mei5882\tcl\tzdata\indian\mahe
- %TEMP%\_mei5882\tcl\tzdata\indian\maldives
- %TEMP%\_mei5882\tcl\tzdata\indian\mauritius
- %TEMP%\_mei5882\tcl\tzdata\indian\mayotte
- %TEMP%\_mei5882\tcl\tzdata\greenwich
- %TEMP%\_mei5882\tcl\tzdata\hst
- %TEMP%\_mei5882\tcl\tzdata\europe\uzhgorod
- %TEMP%\_mei5882\tcl\tzdata\europe\ulyanovsk
- %TEMP%\_mei5882\tcl\tzdata\europe\tiraspol
- %TEMP%\_mei5882\tcl\tzdata\europe\kirov
- %TEMP%\_mei5882\tcl\tzdata\europe\lisbon
- %TEMP%\_mei5882\tcl\tzdata\europe\ljubljana
- %TEMP%\_mei5882\tcl\tzdata\europe\london
- %TEMP%\_mei5882\tcl\tzdata\europe\luxembourg
- %TEMP%\_mei5882\tcl\tzdata\europe\madrid
- %TEMP%\_mei5882\tcl\tzdata\europe\malta
- %TEMP%\_mei5882\tcl\tzdata\europe\mariehamn
- %TEMP%\_mei5882\tcl\tzdata\europe\minsk
- %TEMP%\_mei5882\tcl\tzdata\europe\monaco
- %TEMP%\_mei5882\tcl\tzdata\europe\moscow
- %TEMP%\_mei5882\tcl\tzdata\europe\nicosia
- %TEMP%\_mei5882\tcl\tzdata\europe\oslo
- %TEMP%\_mei5882\tcl\tzdata\europe\kiev
- %TEMP%\_mei5882\tcl\tzdata\europe\paris
- %TEMP%\_mei5882\tcl\tzdata\europe\prague
- %TEMP%\_mei5882\tcl\tzdata\europe\riga
- %TEMP%\_mei5882\tcl\tzdata\europe\rome
- %TEMP%\_mei5882\tcl\tzdata\europe\samara
- %TEMP%\_mei5882\tcl\tzdata\europe\san_marino
- %TEMP%\_mei5882\tcl\tzdata\europe\sarajevo
- %TEMP%\_mei5882\tcl\tzdata\europe\saratov
- %TEMP%\_mei5882\tcl\tzdata\europe\simferopol
- %TEMP%\_mei5882\tcl\tzdata\europe\skopje
- %TEMP%\_mei5882\tcl\tzdata\europe\sofia
- %TEMP%\_mei5882\tcl\tzdata\europe\stockholm
- %TEMP%\_mei5882\tcl\tzdata\europe\tallinn
- %TEMP%\_mei5882\tcl\tzdata\europe\tirane
- %TEMP%\_mei5882\tcl\tzdata\europe\podgorica
- %TEMP%\_mei5882\tcl\tzdata\indian\reunion
- %TEMP%\_mei5882\tcl\tzdata\europe\istanbul
- %TEMP%\_mei5882\tcl\tzdata\singapore
- %TEMP%\_mei5882\tcl\tzdata\jamaica
- %TEMP%\_mei5882\tcl\tzdata\pacific\majuro
- %TEMP%\_mei5882\tcl\tzdata\pacific\marquesas
- %TEMP%\_mei5882\tcl\tzdata\pacific\midway
- %TEMP%\_mei5882\tcl\tzdata\pacific\nauru
- %TEMP%\_mei5882\tcl\tzdata\pacific\niue
- %TEMP%\_mei5882\tcl\tzdata\pacific\norfolk
- %TEMP%\_mei5882\tcl\tzdata\pacific\noumea
- %TEMP%\_mei5882\tcl\tzdata\pacific\pago_pago
- %TEMP%\_mei5882\tcl\tzdata\pacific\palau
- %TEMP%\_mei5882\tcl\tzdata\pacific\pitcairn
- %TEMP%\_mei5882\tcl\tzdata\pacific\pohnpei
- %TEMP%\_mei5882\tcl\tzdata\pacific\ponape
- %TEMP%\_mei5882\tcl\tzdata\pacific\kosrae
- %TEMP%\_mei5882\tcl\tzdata\pacific\kwajalein
- %TEMP%\_mei5882\tcl\tzdata\pacific\port_moresby
- %TEMP%\_mei5882\tcl\tzdata\pacific\samoa
- %TEMP%\_mei5882\tcl\tzdata\pacific\tahiti
- %TEMP%\_mei5882\tcl\tzdata\pacific\tarawa
- %TEMP%\_mei5882\tcl\tzdata\pacific\tongatapu
- %TEMP%\_mei5882\tcl\tzdata\pacific\truk
- %TEMP%\_mei5882\tcl\tzdata\pacific\wake
- %TEMP%\_mei5882\tcl\tzdata\pacific\wallis
- %TEMP%\_mei5882\tcl\tzdata\pacific\yap
- %TEMP%\_mei5882\tcl\tzdata\poland
- %TEMP%\_mei5882\tcl\tzdata\portugal
- %TEMP%\_mei5882\tcl\tzdata\roc
- %TEMP%\_mei5882\tcl\tzdata\rok
- %TEMP%\_mei5882\tcl\tzdata\pacific\rarotonga
- %TEMP%\_mei5882\tcl\tzdata\pacific\saipan
- %TEMP%\_mei5882\tcl\tzdata\pacific\kiritimati
- %TEMP%\_mei5882\tcl\tzdata\pacific\johnston
- %TEMP%\_mei5882\tcl\tzdata\pacific\honolulu
- %TEMP%\_mei5882\tcl\tzdata\kwajalein
- %TEMP%\_mei5882\tcl\tzdata\libya
- %TEMP%\_mei5882\tcl\tzdata\met
- %TEMP%\_mei5882\tcl\tzdata\mst
- %TEMP%\_mei5882\tcl\tzdata\mst7mdt
- %TEMP%\_mei5882\tcl\tzdata\mexico\bajanorte
- %TEMP%\_mei5882\tcl\tzdata\mexico\bajasur
- %TEMP%\_mei5882\tcl\tzdata\mexico\general
- %TEMP%\_mei5882\tcl\tzdata\nz
- %TEMP%\_mei5882\tcl\tzdata\nz-chat
- %TEMP%\_mei5882\tcl\tzdata\navajo
- %TEMP%\_mei5882\tcl\tzdata\prc
- %TEMP%\_mei5882\tcl\tzdata\pst8pdt
- %TEMP%\_mei5882\tcl\tzdata\japan
- %TEMP%\_mei5882\tcl\tzdata\pacific\apia
- %TEMP%\_mei5882\tcl\tzdata\pacific\bougainville
- %TEMP%\_mei5882\tcl\tzdata\pacific\chatham
- %TEMP%\_mei5882\tcl\tzdata\pacific\chuuk
- %TEMP%\_mei5882\tcl\tzdata\pacific\easter
- %TEMP%\_mei5882\tcl\tzdata\pacific\efate
- %TEMP%\_mei5882\tcl\tzdata\pacific\enderbury
- %TEMP%\_mei5882\tcl\tzdata\pacific\fakaofo
- %TEMP%\_mei5882\tcl\tzdata\pacific\fiji
- %TEMP%\_mei5882\tcl\tzdata\pacific\funafuti
- %TEMP%\_mei5882\tcl\tzdata\pacific\galapagos
- %TEMP%\_mei5882\tcl\tzdata\pacific\gambier
- %TEMP%\_mei5882\tcl\tzdata\pacific\guadalcanal
- %TEMP%\_mei5882\tcl\tzdata\pacific\guam
- %TEMP%\_mei5882\tcl\tzdata\pacific\auckland
- %TEMP%\_mei5882\tcl\tzdata\systemv\ast4
- %TEMP%\_mei5882\tk\msgs\cs.msg
- %TEMP%\_mei5882\tcl\tzdata\america\puerto_rico
- %TEMP%\_mei5882\tcl\tzdata\america\grenada
- %TEMP%\_mei5882\tcl\encoding\iso8859-14.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-15.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-16.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-2.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-3.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-4.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-5.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-6.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-7.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-8.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-9.enc
- %TEMP%\_mei5882\tcl\encoding\jis0201.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-10.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-13.enc
- %TEMP%\_mei5882\tcl\encoding\jis0208.enc
- %TEMP%\_mei5882\tcl\encoding\koi8-u.enc
- %TEMP%\_mei5882\tcl\encoding\ksc5601.enc
- %TEMP%\_mei5882\tcl\encoding\maccenteuro.enc
- %TEMP%\_mei5882\tcl\encoding\maccroatian.enc
- %TEMP%\_mei5882\tcl\encoding\maccyrillic.enc
- %TEMP%\_mei5882\tcl\encoding\macdingbats.enc
- %TEMP%\_mei5882\tcl\encoding\macgreek.enc
- %TEMP%\_mei5882\tcl\encoding\maciceland.enc
- %TEMP%\_mei5882\tcl\encoding\macjapan.enc
- %TEMP%\_mei5882\tcl\encoding\macroman.enc
- %TEMP%\_mei5882\tcl\encoding\macromania.enc
- %TEMP%\_mei5882\tcl\encoding\macthai.enc
- %TEMP%\_mei5882\tcl\encoding\jis0212.enc
- %TEMP%\_mei5882\tcl\encoding\koi8-r.enc
- %TEMP%\_mei5882\tcl\encoding\iso8859-1.enc
- %TEMP%\_mei5882\tcl\encoding\iso2022.enc
- %TEMP%\_mei5882\tcl\encoding\iso2022-kr.enc
- %TEMP%\_mei5882\tcl\encoding\cp775.enc
- %TEMP%\_mei5882\tcl\encoding\cp850.enc
- %TEMP%\_mei5882\tcl\encoding\cp852.enc
- %TEMP%\_mei5882\tcl\encoding\cp855.enc
- %TEMP%\_mei5882\tcl\encoding\cp857.enc
- %TEMP%\_mei5882\tcl\encoding\cp860.enc
- %TEMP%\_mei5882\tcl\encoding\cp861.enc
- %TEMP%\_mei5882\tcl\encoding\cp862.enc
- %TEMP%\_mei5882\tcl\encoding\cp863.enc
- %TEMP%\_mei5882\tcl\encoding\cp864.enc
- %TEMP%\_mei5882\tcl\encoding\cp865.enc
- %TEMP%\_mei5882\tcl\encoding\cp866.enc
- %TEMP%\_mei5882\tcl\encoding\cp869.enc
- %TEMP%\_mei5882\tcl\encoding\cp737.enc
- %TEMP%\_mei5882\tcl\encoding\cp874.enc
- %TEMP%\_mei5882\tcl\encoding\cp936.enc
- %TEMP%\_mei5882\tcl\encoding\cp949.enc
- %TEMP%\_mei5882\tcl\encoding\cp950.enc
- %TEMP%\_mei5882\tcl\encoding\dingbats.enc
- %TEMP%\_mei5882\tcl\encoding\ebcdic.enc
- %TEMP%\_mei5882\tcl\encoding\euc-cn.enc
- %TEMP%\_mei5882\tcl\encoding\euc-jp.enc
- %TEMP%\_mei5882\tcl\encoding\euc-kr.enc
- %TEMP%\_mei5882\tcl\encoding\gb12345.enc
- %TEMP%\_mei5882\tcl\encoding\gb1988.enc
- %TEMP%\_mei5882\tcl\encoding\gb2312-raw.enc
- %TEMP%\_mei5882\tcl\encoding\gb2312.enc
- %TEMP%\_mei5882\tcl\encoding\iso2022-jp.enc
- %TEMP%\_mei5882\tcl\encoding\cp932.enc
- %TEMP%\_mei5882\tcl\encoding\macturkish.enc
- %TEMP%\_mei5882\tcl\encoding\shiftjis.enc
- %TEMP%\_mei5882\tcl\msgs\fa_ir.msg
- %TEMP%\_mei5882\tcl\encoding\symbol.enc
- %TEMP%\_mei5882\tcl\msgs\en_za.msg
- %TEMP%\_mei5882\tcl\msgs\en_zw.msg
- %TEMP%\_mei5882\tcl\msgs\eo.msg
- %TEMP%\_mei5882\tcl\msgs\es.msg
- %TEMP%\_mei5882\tcl\msgs\es_ar.msg
- %TEMP%\_mei5882\tcl\msgs\es_bo.msg
- %TEMP%\_mei5882\tcl\msgs\es_cl.msg
- %TEMP%\_mei5882\tcl\msgs\es_co.msg
- %TEMP%\_mei5882\tcl\msgs\es_cr.msg
- %TEMP%\_mei5882\tcl\msgs\es_do.msg
- %TEMP%\_mei5882\tcl\msgs\es_ec.msg
- %TEMP%\_mei5882\tcl\msgs\es_gt.msg
- %TEMP%\_mei5882\tcl\msgs\en_ph.msg
- %TEMP%\_mei5882\tcl\msgs\en_sg.msg
- %TEMP%\_mei5882\tcl\msgs\es_hn.msg
- %TEMP%\_mei5882\tcl\msgs\es_pa.msg
- %TEMP%\_mei5882\tcl\msgs\es_pe.msg
- %TEMP%\_mei5882\tcl\msgs\es_pr.msg
- %TEMP%\_mei5882\tcl\msgs\es_py.msg
- %TEMP%\_mei5882\tcl\msgs\es_sv.msg
- %TEMP%\_mei5882\tcl\msgs\es_uy.msg
- %TEMP%\_mei5882\tcl\msgs\es_ve.msg
- %TEMP%\_mei5882\tcl\msgs\et.msg
- %TEMP%\_mei5882\tcl\msgs\eu.msg
- %TEMP%\_mei5882\tcl\msgs\eu_es.msg
- %TEMP%\_mei5882\tcl\msgs\fa.msg
- %TEMP%\_mei5882\tcl\msgs\fa_in.msg
- %TEMP%\_mei5882\tcl\msgs\es_mx.msg
- %TEMP%\_mei5882\tcl\msgs\es_ni.msg
- %TEMP%\_mei5882\tcl\msgs\en_nz.msg
- %TEMP%\_mei5882\tcl\msgs\en_in.msg
- %TEMP%\_mei5882\tcl\msgs\en_ie.msg
- %TEMP%\_mei5882\tcl\history.tcl
- %TEMP%\_mei5882\tcl\http1.0\http.tcl
- %TEMP%\_mei5882\tcl\http1.0\pkgindex.tcl
- %TEMP%\_mei5882\tcl\init.tcl
- %TEMP%\_mei5882\tcl\msgs\af.msg
- %TEMP%\_mei5882\tcl\msgs\af_za.msg
- %TEMP%\_mei5882\tcl\msgs\ar.msg
- %TEMP%\_mei5882\tcl\msgs\ar_in.msg
- %TEMP%\_mei5882\tcl\msgs\ar_jo.msg
- %TEMP%\_mei5882\tcl\msgs\ar_lb.msg
- %TEMP%\_mei5882\tcl\msgs\ar_sy.msg
- %TEMP%\_mei5882\tcl\msgs\be.msg
- %TEMP%\_mei5882\tcl\msgs\bg.msg
- %TEMP%\_mei5882\tcl\encoding\tis-620.enc
- %TEMP%\_mei5882\tcl\msgs\bn.msg
- %TEMP%\_mei5882\tcl\msgs\ca.msg
- %TEMP%\_mei5882\tcl\msgs\cs.msg
- %TEMP%\_mei5882\tcl\msgs\da.msg
- %TEMP%\_mei5882\tcl\msgs\de.msg
- %TEMP%\_mei5882\tcl\msgs\de_at.msg
- %TEMP%\_mei5882\tcl\msgs\de_be.msg
- %TEMP%\_mei5882\tcl\msgs\el.msg
- %TEMP%\_mei5882\tcl\msgs\en_au.msg
- %TEMP%\_mei5882\tcl\msgs\en_be.msg
- %TEMP%\_mei5882\tcl\msgs\en_bw.msg
- %TEMP%\_mei5882\tcl\msgs\en_ca.msg
- %TEMP%\_mei5882\tcl\msgs\en_gb.msg
- %TEMP%\_mei5882\tcl\msgs\en_hk.msg
- %TEMP%\_mei5882\tcl\msgs\bn_in.msg
- %TEMP%\_mei5882\tcl\encoding\cp437.enc
- %TEMP%\_mei5882\tcl\encoding\macukraine.enc
- %TEMP%\_mei5882\tcl\encoding\cp1258.enc
- %TEMP%\_mei5882\libopenblas.vtyum5mxkvfe4pzzer3l7pno6yb4xff3.gfortran-win32.dll
- %TEMP%\_mei5882\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei5882\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei5882\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei5882\charset_normalizer\md.cp37-win32.pyd
- %TEMP%\_mei5882\charset_normalizer\md__mypyc.cp37-win32.pyd
- %TEMP%\_mei5882\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei5882\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei5882\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei5882\pil\_imagingft.cp37-win32.pyd
- %TEMP%\_mei5882\pil\_imagingtk.cp37-win32.pyd
- %TEMP%\_mei5882\pil\_webp.cp37-win32.pyd
- %TEMP%\_mei5882\pythonwin\mfc140u.dll
- %TEMP%\_mei5882\pythonwin\win32ui.pyd
- %TEMP%\_mei5882\vcruntime140.dll
- %TEMP%\_mei5882\_bz2.pyd
- %TEMP%\_mei5882\_cffi_backend.cp37-win32.pyd
- %TEMP%\_mei5882\_contextvars.pyd
- %TEMP%\_mei5882\_ctypes.pyd
- %TEMP%\_mei5882\_decimal.pyd
- %TEMP%\_mei5882\_hashlib.pyd
- %TEMP%\_mei5882\_lzma.pyd
- %TEMP%\_mei5882\pil\_imagingcms.cp37-win32.pyd
- %TEMP%\_mei5882\_multiprocessing.pyd
- %TEMP%\_mei5882\_socket.pyd
- %TEMP%\_mei5882\_ssl.pyd
- %TEMP%\_mei5882\_tkinter.pyd
- %TEMP%\_mei5882\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei5882\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei5882\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei5882\_queue.pyd
- %TEMP%\_mei5882\libcrypto-1_1.dll
- %TEMP%\_mei5882\libssl-1_1.dll
- %TEMP%\_mei5882\tcl\encoding\cp1256.enc
- %TEMP%\_mei5882\numpy\core\_multiarray_tests.cp37-win32.pyd
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\license.apache
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\license.bsd
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\metadata
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\record
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\wheel
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\top_level.txt
- %TEMP%\_mei5882\importlib_metadata-6.7.0.dist-info\installer
- %TEMP%\_mei5882\importlib_metadata-6.7.0.dist-info\license
- %TEMP%\_mei5882\importlib_metadata-6.7.0.dist-info\metadata
- %TEMP%\_mei5882\importlib_metadata-6.7.0.dist-info\record
- %TEMP%\_mei5882\importlib_metadata-6.7.0.dist-info\wheel
- %TEMP%\_mei5882\importlib_metadata-6.7.0.dist-info\top_level.txt
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\installer
- %TEMP%\_mei5882\cryptography-41.0.7.dist-info\license
- %TEMP%\_mei5882\tcl8\8.4\platform-1.0.14.tm
- %TEMP%\_mei5882\tcl8\8.5\tcltest-2.4.1.tm
- %TEMP%\_mei5882\tcl8\8.6\http-2.8.12.tm
- %TEMP%\_mei5882\tcl\auto.tcl
- %TEMP%\_mei5882\tcl\clock.tcl
- %TEMP%\_mei5882\tcl\encoding\ascii.enc
- %TEMP%\_mei5882\tcl\encoding\big5.enc
- %TEMP%\_mei5882\tcl\encoding\cp1250.enc
- %TEMP%\_mei5882\tcl\encoding\cp1251.enc
- %TEMP%\_mei5882\tcl\encoding\cp1252.enc
- %TEMP%\_mei5882\tcl\encoding\cp1253.enc
- %TEMP%\_mei5882\tcl\encoding\cp1254.enc
- %TEMP%\_mei5882\tcl\encoding\cp1255.enc
- %TEMP%\_mei5882\tcl8\8.4\platform\shell-1.1.4.tm
- %TEMP%\_mei5882\tcl8\8.5\msgcat-1.6.1.tm
- %TEMP%\_mei5882\certifi\cacert.pem
- %TEMP%\_mei5882\base_library.zip
- %TEMP%\_mei5882\win32\win32trace.pyd
- %TEMP%\_mei5882\numpy\fft\_pocketfft_internal.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\linalg\_umath_linalg.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\linalg\lapack_lite.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\_bounded_integers.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\_common.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\_generator.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\_mt19937.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\_pcg64.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\_philox.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\_sfc64.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\bit_generator.cp37-win32.pyd
- %TEMP%\_mei5882\numpy\random\mtrand.cp37-win32.pyd
- %TEMP%\_mei5882\psutil\_psutil_windows.pyd
- %TEMP%\_mei5882\numpy\core\_multiarray_umath.cp37-win32.pyd
- %TEMP%\_mei5882\pyexpat.pyd
- %TEMP%\_mei5882\python37.dll
- %TEMP%\_mei5882\pywin32_system32\pythoncom37.dll
- %TEMP%\_mei5882\pywin32_system32\pywintypes37.dll
- %TEMP%\_mei5882\pywintypes37.dll
- %TEMP%\_mei5882\select.pyd
- %TEMP%\_mei5882\tcl86t.dll
- %TEMP%\_mei5882\tk86t.dll
- %TEMP%\_mei5882\ucrtbase.dll
- %TEMP%\_mei5882\unicodedata.pyd
- %TEMP%\_mei5882\win32\_win32sysloader.pyd
- %TEMP%\_mei5882\win32\win32api.pyd
- %TEMP%\_mei5882\win32\win32gui.pyd
- %TEMP%\_mei5882\win32\win32pdh.pyd
- %TEMP%\_mei5882\python3.dll
- %TEMP%\_mei5882\tcl\encoding\cp1257.enc
- %TEMP%\_mei5882\tcl\msgs\zh_cn.msg
- %TEMP%\_mei5882\tcl\tzdata\america\porto_acre
- %TEMP%\_mei5882\tcl\msgs\fo_fo.msg
- %TEMP%\_mei5882\tcl\tzdata\america\catamarca
- %TEMP%\_mei5882\tcl\tzdata\america\cayenne
- %TEMP%\_mei5882\tcl\tzdata\america\cayman
- %TEMP%\_mei5882\tcl\tzdata\america\chicago
- %TEMP%\_mei5882\tcl\tzdata\america\chihuahua
- %TEMP%\_mei5882\tcl\tzdata\america\coral_harbour
- %TEMP%\_mei5882\tcl\tzdata\america\cordoba
- %TEMP%\_mei5882\tcl\tzdata\america\costa_rica
- %TEMP%\_mei5882\tcl\tzdata\america\creston
- %TEMP%\_mei5882\tcl\tzdata\america\cuiaba
- %TEMP%\_mei5882\tcl\tzdata\america\curacao
- %TEMP%\_mei5882\tcl\tzdata\america\danmarkshavn
- %TEMP%\_mei5882\tcl\tzdata\america\cancun
- %TEMP%\_mei5882\tcl\tzdata\america\caracas
- %TEMP%\_mei5882\tcl\tzdata\america\dawson
- %TEMP%\_mei5882\tcl\tzdata\america\detroit
- %TEMP%\_mei5882\tcl\tzdata\america\dominica
- %TEMP%\_mei5882\tcl\tzdata\america\edmonton
- %TEMP%\_mei5882\tcl\tzdata\america\eirunepe
- %TEMP%\_mei5882\tcl\tzdata\america\el_salvador
- %TEMP%\_mei5882\tcl\tzdata\america\ensenada
- %TEMP%\_mei5882\tcl\tzdata\america\fort_nelson
- %TEMP%\_mei5882\tcl\tzdata\america\fort_wayne
- %TEMP%\_mei5882\tcl\tzdata\america\fortaleza
- %TEMP%\_mei5882\tcl\tzdata\america\glace_bay
- %TEMP%\_mei5882\tcl\tzdata\america\godthab
- %TEMP%\_mei5882\tcl\tzdata\america\goose_bay
- %TEMP%\_mei5882\tcl\tzdata\america\dawson_creek
- %TEMP%\_mei5882\tcl\tzdata\america\denver
- %TEMP%\_mei5882\tcl\tzdata\america\campo_grande
- %TEMP%\_mei5882\tcl\tzdata\america\cambridge_bay
- %TEMP%\_mei5882\tcl\tzdata\america\buenos_aires
- %TEMP%\_mei5882\tcl\tzdata\america\antigua
- %TEMP%\_mei5882\tcl\tzdata\america\araguaina
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\buenos_aires
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\catamarca
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\comodrivadavia
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\cordoba
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\jujuy
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\la_rioja
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\mendoza
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\rio_gallegos
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\salta
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\san_juan
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\san_luis
- %TEMP%\_mei5882\tcl\tzdata\america\anguilla
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\tucuman
- %TEMP%\_mei5882\tcl\tzdata\america\aruba
- %TEMP%\_mei5882\tcl\tzdata\america\asuncion
- %TEMP%\_mei5882\tcl\tzdata\america\atikokan
- %TEMP%\_mei5882\tcl\tzdata\america\atka
- %TEMP%\_mei5882\tcl\tzdata\america\bahia
- %TEMP%\_mei5882\tcl\tzdata\america\bahia_banderas
- %TEMP%\_mei5882\tcl\tzdata\america\barbados
- %TEMP%\_mei5882\tcl\tzdata\america\belem
- %TEMP%\_mei5882\tcl\tzdata\america\belize
- %TEMP%\_mei5882\tcl\tzdata\america\blanc-sablon
- %TEMP%\_mei5882\tcl\tzdata\america\boa_vista
- %TEMP%\_mei5882\tcl\tzdata\america\bogota
- %TEMP%\_mei5882\tcl\tzdata\america\boise
- %TEMP%\_mei5882\tcl\tzdata\america\argentina\ushuaia
- %TEMP%\_mei5882\tcl\tzdata\america\grand_turk
- %TEMP%\_mei5882\tcl\tzdata\america\guadeloupe
- %TEMP%\_mei5882\tcl\msgs\fo.msg
- %TEMP%\_mei5882\tcl\tzdata\america\guatemala
- %TEMP%\_mei5882\tcl\tzdata\america\mazatlan
- %TEMP%\_mei5882\tcl\tzdata\america\mendoza
- %TEMP%\_mei5882\tcl\tzdata\america\menominee
- %TEMP%\_mei5882\tcl\tzdata\america\merida
- %TEMP%\_mei5882\tcl\tzdata\america\metlakatla
- %TEMP%\_mei5882\tcl\tzdata\america\mexico_city
- %TEMP%\_mei5882\tcl\tzdata\america\miquelon
- %TEMP%\_mei5882\tcl\tzdata\america\moncton
- %TEMP%\_mei5882\tcl\tzdata\america\monterrey
- %TEMP%\_mei5882\tcl\tzdata\america\montevideo
- %TEMP%\_mei5882\tcl\tzdata\america\montreal
- %TEMP%\_mei5882\tcl\tzdata\america\montserrat
- %TEMP%\_mei5882\tcl\tzdata\america\martinique
- %TEMP%\_mei5882\tcl\tzdata\america\matamoros
- %TEMP%\_mei5882\tcl\tzdata\america\nassau
- %TEMP%\_mei5882\tcl\tzdata\america\nome
- %TEMP%\_mei5882\tcl\tzdata\america\noronha
- %TEMP%\_mei5882\tcl\tzdata\america\north_dakota\beulah
- %TEMP%\_mei5882\tcl\tzdata\america\north_dakota\center
- %TEMP%\_mei5882\tcl\tzdata\america\north_dakota\new_salem
- %TEMP%\_mei5882\tcl\tzdata\america\ojinaga
- %TEMP%\_mei5882\tcl\tzdata\america\panama
- %TEMP%\_mei5882\tcl\tzdata\america\pangnirtung
- %TEMP%\_mei5882\tcl\tzdata\america\paramaribo
- %TEMP%\_mei5882\tcl\tzdata\america\phoenix
- %TEMP%\_mei5882\tcl\tzdata\america\port-au-prince
- %TEMP%\_mei5882\tcl\tzdata\america\port_of_spain
- %TEMP%\_mei5882\tcl\tzdata\america\new_york
- %TEMP%\_mei5882\tcl\tzdata\america\nipigon
- %TEMP%\_mei5882\tcl\tzdata\america\marigot
- %TEMP%\_mei5882\tcl\tzdata\america\manaus
- %TEMP%\_mei5882\tcl\tzdata\america\managua
- %TEMP%\_mei5882\tcl\tzdata\america\guyana
- %TEMP%\_mei5882\tcl\tzdata\america\halifax
- %TEMP%\_mei5882\tcl\tzdata\america\havana
- %TEMP%\_mei5882\tcl\tzdata\america\hermosillo
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\indianapolis
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\knox
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\marengo
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\petersburg
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\tell_city
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\vevay
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\vincennes
- %TEMP%\_mei5882\tcl\tzdata\america\indiana\winamac
- %TEMP%\_mei5882\tcl\tzdata\america\indianapolis
- %TEMP%\_mei5882\tcl\tzdata\america\guayaquil
- %TEMP%\_mei5882\tcl\tzdata\america\inuvik
- %TEMP%\_mei5882\tcl\tzdata\america\jamaica
- %TEMP%\_mei5882\tcl\tzdata\america\jujuy
- %TEMP%\_mei5882\tcl\tzdata\america\juneau
- %TEMP%\_mei5882\tcl\tzdata\america\kentucky\louisville
- %TEMP%\_mei5882\tcl\tzdata\america\kentucky\monticello
- %TEMP%\_mei5882\tcl\tzdata\america\knox_in
- %TEMP%\_mei5882\tcl\tzdata\america\kralendijk
- %TEMP%\_mei5882\tcl\tzdata\america\la_paz
- %TEMP%\_mei5882\tcl\tzdata\america\lima
- %TEMP%\_mei5882\tcl\tzdata\america\los_angeles
- %TEMP%\_mei5882\tcl\tzdata\america\louisville
- %TEMP%\_mei5882\tcl\tzdata\america\lower_princes
- %TEMP%\_mei5882\tcl\tzdata\america\maceio
- %TEMP%\_mei5882\tcl\tzdata\america\iqaluit
- %TEMP%\_mei5882\tcl\tzdata\america\anchorage
- %TEMP%\_mei5882\tcl\tzdata\america\porto_velho
- %TEMP%\_mei5882\tcl\tzdata\america\adak
- %TEMP%\_mei5882\tcl\msgs\zh.msg
- %TEMP%\_mei5882\tcl\msgs\ms.msg
- %TEMP%\_mei5882\tcl\msgs\ms_my.msg
- %TEMP%\_mei5882\tcl\msgs\mt.msg
- %TEMP%\_mei5882\tcl\msgs\nb.msg
- %TEMP%\_mei5882\tcl\msgs\nl.msg
- %TEMP%\_mei5882\tcl\msgs\nl_be.msg
- %TEMP%\_mei5882\tcl\msgs\nn.msg
- %TEMP%\_mei5882\tcl\msgs\pl.msg
- %TEMP%\_mei5882\tcl\msgs\pt.msg
- %TEMP%\_mei5882\tcl\msgs\pt_br.msg
- %TEMP%\_mei5882\tcl\msgs\ro.msg
- %TEMP%\_mei5882\tcl\msgs\ru.msg
- %TEMP%\_mei5882\tcl\msgs\mr.msg
- %TEMP%\_mei5882\tcl\msgs\mr_in.msg
- %TEMP%\_mei5882\tcl\msgs\ru_ua.msg
- %TEMP%\_mei5882\tcl\msgs\sl.msg
- %TEMP%\_mei5882\tcl\msgs\sq.msg
- %TEMP%\_mei5882\tcl\msgs\sr.msg
- %TEMP%\_mei5882\tcl\msgs\sv.msg
- %TEMP%\_mei5882\tcl\msgs\sw.msg
- %TEMP%\_mei5882\tcl\msgs\ta.msg
- %TEMP%\_mei5882\tcl\msgs\ta_in.msg
- %TEMP%\_mei5882\tcl\msgs\te.msg
- %TEMP%\_mei5882\tcl\msgs\te_in.msg
- %TEMP%\_mei5882\tcl\msgs\th.msg
- %TEMP%\_mei5882\tcl\msgs\tr.msg
- %TEMP%\_mei5882\tcl\msgs\uk.msg
- %TEMP%\_mei5882\tcl\msgs\sh.msg
- %TEMP%\_mei5882\tcl\msgs\sk.msg
- %TEMP%\_mei5882\tcl\msgs\mk.msg
- %TEMP%\_mei5882\tcl\msgs\lv.msg
- %TEMP%\_mei5882\tcl\msgs\lt.msg
- %TEMP%\_mei5882\tcl\msgs\fr_be.msg
- %TEMP%\_mei5882\tcl\msgs\fr_ca.msg
- %TEMP%\_mei5882\tcl\msgs\fr_ch.msg
- %TEMP%\_mei5882\tcl\msgs\ga.msg
- %TEMP%\_mei5882\tcl\msgs\ga_ie.msg
- %TEMP%\_mei5882\tcl\msgs\gl.msg
- %TEMP%\_mei5882\tcl\msgs\gl_es.msg
- %TEMP%\_mei5882\tcl\msgs\gv.msg
- %TEMP%\_mei5882\tcl\msgs\gv_gb.msg
- %TEMP%\_mei5882\tcl\msgs\he.msg
- %TEMP%\_mei5882\tcl\msgs\hi.msg
- %TEMP%\_mei5882\tcl\msgs\hi_in.msg
- %TEMP%\_mei5882\tcl\msgs\hr.msg
- %TEMP%\_mei5882\tcl\msgs\fr.msg
- %TEMP%\_mei5882\tcl\msgs\hu.msg
- %TEMP%\_mei5882\tcl\msgs\id_id.msg
- %TEMP%\_mei5882\tcl\msgs\is.msg
- %TEMP%\_mei5882\tcl\msgs\it.msg
- %TEMP%\_mei5882\tcl\msgs\it_ch.msg
- %TEMP%\_mei5882\tcl\msgs\ja.msg
- %TEMP%\_mei5882\tcl\msgs\kl.msg
- %TEMP%\_mei5882\tcl\msgs\kl_gl.msg
- %TEMP%\_mei5882\tcl\msgs\ko.msg
- %TEMP%\_mei5882\tcl\msgs\ko_kr.msg
- %TEMP%\_mei5882\tcl\msgs\kok.msg
- %TEMP%\_mei5882\tcl\msgs\kok_in.msg
- %TEMP%\_mei5882\tcl\msgs\kw.msg
- %TEMP%\_mei5882\tcl\msgs\kw_gb.msg
- %TEMP%\_mei5882\tcl\msgs\id.msg
- %TEMP%\_mei5882\tcl\msgs\vi.msg
- %TEMP%\_mei5882\tcl\msgs\fi.msg
- %TEMP%\_mei5882\tcl\tzdata\africa\tunis
- %TEMP%\_mei5882\tcl\msgs\zh_hk.msg
- %TEMP%\_mei5882\tcl\tzdata\africa\johannesburg
- %TEMP%\_mei5882\tcl\tzdata\africa\juba
- %TEMP%\_mei5882\tcl\tzdata\africa\kampala
- %TEMP%\_mei5882\tcl\tzdata\africa\khartoum
- %TEMP%\_mei5882\tcl\tzdata\africa\kigali
- %TEMP%\_mei5882\tcl\tzdata\africa\kinshasa
- %TEMP%\_mei5882\tcl\tzdata\africa\lagos
- %TEMP%\_mei5882\tcl\tzdata\africa\libreville
- %TEMP%\_mei5882\tcl\tzdata\africa\lome
- %TEMP%\_mei5882\tcl\tzdata\africa\luanda
- %TEMP%\_mei5882\tcl\tzdata\africa\lubumbashi
- %TEMP%\_mei5882\tcl\tzdata\africa\lusaka
- %TEMP%\_mei5882\tcl\tzdata\africa\gaborone
- %TEMP%\_mei5882\tcl\tzdata\africa\harare
- %TEMP%\_mei5882\tcl\tzdata\africa\malabo
- %TEMP%\_mei5882\tcl\tzdata\africa\mbabane
- %TEMP%\_mei5882\tcl\tzdata\africa\mogadishu
- %TEMP%\_mei5882\tcl\tzdata\africa\monrovia
- %TEMP%\_mei5882\tcl\tzdata\africa\nairobi
- %TEMP%\_mei5882\tcl\tzdata\africa\ndjamena
- %TEMP%\_mei5882\tcl\tzdata\africa\niamey
- %TEMP%\_mei5882\tcl\tzdata\africa\nouakchott
- %TEMP%\_mei5882\tcl\tzdata\africa\ouagadougou
- %TEMP%\_mei5882\tcl\tzdata\africa\porto-novo
- %TEMP%\_mei5882\tcl\tzdata\africa\sao_tome
- %TEMP%\_mei5882\tcl\tzdata\africa\timbuktu
- %TEMP%\_mei5882\tcl\tzdata\africa\tripoli
- %TEMP%\_mei5882\tcl\tzdata\africa\maputo
- %TEMP%\_mei5882\tcl\tzdata\africa\maseru
- %TEMP%\_mei5882\tcl\tzdata\africa\freetown
- %TEMP%\_mei5882\tcl\tzdata\africa\el_aaiun
- %TEMP%\_mei5882\tcl\tzdata\africa\douala
- %TEMP%\_mei5882\tcl\msgs\zh_tw.msg
- %TEMP%\_mei5882\tcl\opt0.4\optparse.tcl
- %TEMP%\_mei5882\tcl\opt0.4\pkgindex.tcl
- %TEMP%\_mei5882\tcl\package.tcl
- %TEMP%\_mei5882\tcl\parray.tcl
- %TEMP%\_mei5882\tcl\safe.tcl
- %TEMP%\_mei5882\tcl\tclindex
- %TEMP%\_mei5882\tcl\tm.tcl
- %TEMP%\_mei5882\tcl\tzdata\africa\abidjan
- %TEMP%\_mei5882\tcl\tzdata\africa\accra
- %TEMP%\_mei5882\tcl\tzdata\africa\addis_ababa
- %TEMP%\_mei5882\tcl\tzdata\africa\algiers
- %TEMP%\_mei5882\tcl\tzdata\africa\asmara
- %TEMP%\_mei5882\tcl\msgs\zh_sg.msg
- %TEMP%\_mei5882\tcl\tzdata\africa\asmera
- %TEMP%\_mei5882\tcl\tzdata\africa\bangui
- %TEMP%\_mei5882\tcl\tzdata\africa\banjul
- %TEMP%\_mei5882\tcl\tzdata\africa\bissau
- %TEMP%\_mei5882\tcl\tzdata\africa\blantyre
- %TEMP%\_mei5882\tcl\tzdata\africa\brazzaville
- %TEMP%\_mei5882\tcl\tzdata\africa\bujumbura
- %TEMP%\_mei5882\tcl\tzdata\africa\cairo
- %TEMP%\_mei5882\tcl\tzdata\africa\casablanca
- %TEMP%\_mei5882\tcl\tzdata\africa\ceuta
- %TEMP%\_mei5882\tcl\tzdata\africa\conakry
- %TEMP%\_mei5882\tcl\tzdata\africa\dakar
- %TEMP%\_mei5882\tcl\tzdata\africa\dar_es_salaam
- %TEMP%\_mei5882\tcl\tzdata\africa\djibouti
- %TEMP%\_mei5882\tcl\tzdata\africa\bamako
- %TEMP%\_mei5882\tcl\tzdata\africa\windhoek
- %HOMEPATH%\desktop\custom_wallpaper.jpg
Deletes the following files
- %TEMP%\nqyyjb10
Modifies the following files
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\favorites\msn websites\msn money.url
- %HOMEPATH%\favorites\msn websites\msn entertainment.url
- %HOMEPATH%\favorites\msn websites\msn autos.url
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url
- %HOMEPATH%\favorites\links for united states\usa.gov.url
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
- %HOMEPATH%\favorites\links\web slice gallery.url
- %HOMEPATH%\contacts\user.contact
- %HOMEPATH%\links\recentplaces.lnk
- %HOMEPATH%\links\downloads.lnk
- %HOMEPATH%\links\desktop.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\google chrome.lnk
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\favorites\msn websites\msn sports.url
- %HOMEPATH%\favorites\msn websites\msn.url
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Network activity
Connects to
- 'ht##bin.org':443
- 'ap#.##legram.org':443
TCP
Other
- 'ht##bin.org':443
- 'ap#.##legram.org':443
UDP
- DNS ASK ht##bin.org
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "REG ADD \"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
