ユーザー向け情報

閉じる

マイライブラリ
マイライブラリ

+ マイライブラリに追加

検索
検索

電話
テクニカルサポート利用方法

問い合わせ

新規お問い合わせ

電話

03-6550-8770

フォーラム（英語）

お問い合わせ履歴

新規お問い合わせ

電話

03-6550-8770

Profile

JP

RU CN EN ES FR IT JP KZ UZ BY ID
閉じる
サービス
スキャナー
Dr.Web vxCube
トライアル
ウイルスライブラリ
ナレッジベース

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

ニュース

Trojan.Siggen34.17129

Added to the Dr.Web virus database: 2026-09-20

Virus description added:

Technical Information

Malicious functions
Reads files which store third party applications passwords
  • %LOCALAPPDATA%\google\chrome\user data\default\login data
  • %LOCALAPPDATA%\google\chrome\user data\default\cookies
  • %LOCALAPPDATA%\microsoft\edge\user data\default\login data
  • %LOCALAPPDATA%\microsoft\edge\user data\default\web data
  • %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
  • %TEMP%\_mei000012442\crypto\cipher\_arc4.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_salsa20.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_chacha20.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_pkcs1_decode.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_aes.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_aesni.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_arc2.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_blowfish.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_cast.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_cbc.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_cfb.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ctr.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_des.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_des3.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ecb.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_eksblowfish.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ocb.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ofb.pyd
  • %TEMP%\_mei000012442\crypto\hash\_blake2b.pyd
  • %TEMP%\_mei000012442\crypto\hash\_blake2s.pyd
  • %TEMP%\_mei000012442\crypto\hash\_md2.pyd
  • %TEMP%\_mei000012442\crypto\hash\_md4.pyd
  • %TEMP%\_mei000012442\crypto\hash\_md5.pyd
  • %TEMP%\_mei000012442\crypto\hash\_ripemd160.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha1.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha224.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha256.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha384.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha512.pyd
  • %TEMP%\_mei000012442\crypto\hash\_ghash_clmul.pyd
  • %TEMP%\_mei000012442\crypto\hash\_ghash_portable.pyd
  • %TEMP%\_mei000012442\crypto\hash\_keccak.pyd
  • %TEMP%\_mei000012442\crypto\hash\_poly1305.pyd
  • %TEMP%\_mei000012442\crypto\math\_modexp.pyd
  • %TEMP%\_mei000012442\crypto\protocol\_scrypt.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_curve25519.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_curve448.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_ec_ws.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_ed25519.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_ed448.pyd
  • %TEMP%\_mei000012442\crypto\util\_cpuid_c.pyd
  • %TEMP%\_mei000012442\crypto\util\_strxor.pyd
  • %TEMP%\_mei000012442\pil\_avif.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imaging.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imagingcms.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imagingmath.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imagingtk.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_webp.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\vcruntime140.dll
  • %TEMP%\_mei000012442\vcruntime140_1.dll
  • %TEMP%\_mei000012442\_asyncio.pyd
  • %TEMP%\_mei000012442\_bz2.pyd
  • %TEMP%\_mei000012442\_cffi_backend.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\_ctypes.pyd
  • %TEMP%\_mei000012442\_decimal.pyd
  • %TEMP%\_mei000012442\_elementtree.pyd
  • %TEMP%\_mei000012442\_hashlib.pyd
  • %TEMP%\_mei000012442\_lzma.pyd
  • %TEMP%\_mei000012442\_multiprocessing.pyd
  • %TEMP%\_mei000012442\_overlapped.pyd
  • %TEMP%\_mei000012442\_queue.pyd
  • %TEMP%\_mei000012442\_socket.pyd
  • %TEMP%\_mei000012442\_sqlite3.pyd
  • %TEMP%\_mei000012442\_ssl.pyd
  • %TEMP%\_mei000012442\_uuid.pyd
  • %TEMP%\_mei000012442\_wmi.pyd
  • %TEMP%\_mei000012442\_zstd.pyd
  • %TEMP%\_mei000012442\base_library.zip
  • %TEMP%\_mei000012442\charset_normalizer\cd.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\charset_normalizer\md.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\clr_loader\ffi\dlls\amd64\clrloader.dll
  • %TEMP%\_mei000012442\clr_loader\ffi\dlls\x86\clrloader.dll
  • %TEMP%\_mei000012442\cv2\__init__.py
  • %TEMP%\_mei000012442\cv2\config-3.py
  • %TEMP%\_mei000012442\cv2\config.py
  • %TEMP%\_mei000012442\cv2\cv2.pyd
  • %TEMP%\_mei000012442\cv2\data\__init__.py
  • %TEMP%\_mei000012442\cv2\load_config_py3.py
  • %TEMP%\_mei000012442\cv2\mat_wrapper\__init__.py
  • %TEMP%\_mei000012442\cv2\misc\__init__.py
  • %TEMP%\_mei000012442\cv2\misc\version.py
  • %TEMP%\_mei000012442\cv2\opencv_videoio_ffmpeg500_64.dll
  • %TEMP%\_mei000012442\cv2\typing\__init__.py
  • %TEMP%\_mei000012442\cv2\utils\__init__.py
  • %TEMP%\_mei000012442\cv2\version.py
  • %TEMP%\_mei000012442\libcrypto-3.dll
  • %TEMP%\_mei000012442\libffi-8.dll
  • %TEMP%\_mei000012442\libssl-3.dll
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\delvewheel
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\installer
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\metadata
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\record
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\wheel
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\entry_points.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\include\numpy\libdivide\license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\common\pythoncapi-compat\copying
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\highway\license
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\multiarray\dragon4_license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\npysort\x86-simd-sort\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\umath\svml\license
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\fft\pocketfft\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\linalg\lapack_lite\license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\ma\license
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\distributions\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\mt19937\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\pcg64\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\philox\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\sfc64\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\splitmix64\license.md
  • %TEMP%\_mei000012442\numpy.libs\libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
  • %TEMP%\_mei000012442\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
  • %TEMP%\_mei000012442\numpy\_core\_multiarray_tests.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\fft\_pocketfft_umath.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_bounded_integers.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_common.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_generator.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_mt19937.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_pcg64.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_philox.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_sfc64.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\bit_generator.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\mtrand.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\psutil\_psutil_windows.pyd
  • %TEMP%\_mei000012442\pyexpat.pyd
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\installer
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\metadata
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\record
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\wheel
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\licenses\license.md
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\top_level.txt
  • %TEMP%\_mei000012442\python3.dll
  • %TEMP%\_mei000012442\python314.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\microsoft.win32.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\python.runtime.deps.json
  • %TEMP%\_mei000012442\pythonnet\runtime\python.runtime.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\python.runtime.xml
  • %TEMP%\_mei000012442\pythonnet\runtime\system.appcontext.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.concurrent.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.nongeneric.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.specialized.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.eventbasedasync.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.typeconverter.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.console.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.data.common.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.contracts.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.debug.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.fileversioninfo.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.process.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.stacktrace.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.textwritertracelistener.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.tools.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.tracesource.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.tracing.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.drawing.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.dynamic.runtime.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.globalization.calendars.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.globalization.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.globalization.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.compression.zipfile.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.compression.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.driveinfo.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.watcher.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.isolatedstorage.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.memorymappedfiles.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.pipes.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.unmanagedmemorystream.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.expressions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.parallel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.queryable.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.http.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.nameresolution.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.networkinformation.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.ping.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.requests.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.security.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.sockets.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.webheadercollection.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.websockets.client.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.websockets.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.objectmodel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.reflection.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.reflection.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.reflection.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.resources.reader.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.resources.resourcemanager.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.resources.writer.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.compilerservices.visualc.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.handles.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.interopservices.runtimeinformation.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.interopservices.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.numerics.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.formatters.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.json.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.xml.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.claims.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.algorithms.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.csp.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.encoding.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.x509certificates.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.principal.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.securestring.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.text.encoding.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.text.encoding.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.text.regularexpressions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.overlapped.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.tasks.parallel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.tasks.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.thread.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.threadpool.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.timer.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.valuetuple.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.readerwriter.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xdocument.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xpath.xdocument.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xpath.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xmldocument.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xmlserializer.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\netstandard.dll
  • %TEMP%\_mei000012442\pywin32_system32\pywintypes314.dll
  • %TEMP%\_mei000012442\select.pyd
  • %TEMP%\_mei000012442\setuptools\_vendor\jaraco\text\lorem ipsum.txt
  • %TEMP%\_mei000012442\sqlite3.dll
  • %TEMP%\_mei000012442\unicodedata.pyd
  • %TEMP%\_mei000012442\win32\win32api.pyd
  • %TEMP%\_mei000012442\win32\win32crypt.pyd
  • %TEMP%\_mei000012442\win32\win32evtlog.pyd
  • %TEMP%\_mei000012442\win32\win32pdh.pyd
  • %TEMP%\_mei000012442\yaml\_yaml.cp314-win_amd64.pyd
  • %TEMP%\screenshot_1789951830.png
  • %TEMP%\h4_stash\network\wifi_info.txt
  • %TEMP%\tmpomdgyms4.sqlite
  • %TEMP%\tmphcd1v7xy.sqlite
  • %TEMP%\tmp9amyvqiv.sqlite
  • %TEMP%\tmph5195vfa.sqlite
  • %TEMP%\tmpi9l__329.sqlite
  • %TEMP%\tmpygdun3hv.sqlite
  • %TEMP%\tmpl67ni370.sqlite
  • %TEMP%\h4_stash\browsers\chrome\default\cookies.txt
  • %TEMP%\h4_stash\browsers\edge\default\passwords.txt
  • %TEMP%\h4_stash\browsers\chrome\default\history.txt
  • %TEMP%\h4_stash\browsers\edge\default\history.txt
  • %TEMP%\h4_stash\browsers\edge\default\web_data.txt
  • %TEMP%\h4_unknownuser.zip
Deletes following files that it created itself
  • %TEMP%\tmpomdgyms4.sqlite
  • %TEMP%\tmpi9l__329.sqlite
  • %TEMP%\tmpl67ni370.sqlite
  • %TEMP%\tmphcd1v7xy.sqlite
  • %TEMP%\tmph5195vfa.sqlite
  • %TEMP%\tmpygdun3hv.sqlite
  • %TEMP%\h4_stash\media\screenshot_1789951830.png
  • %TEMP%\h4_unknownuser.zip
  • %TEMP%\h4_stash\browsers\chrome\default\cookies.txt
  • %TEMP%\h4_stash\browsers\chrome\default\history.txt
  • %TEMP%\h4_stash\browsers\edge\default\history.txt
  • %TEMP%\h4_stash\browsers\edge\default\passwords.txt
  • %TEMP%\h4_stash\browsers\edge\default\web_data.txt
  • %TEMP%\h4_stash\network\wifi_info.txt
  • %TEMP%\_mei000012442\base_library.zip
  • %TEMP%\_mei000012442\charset_normalizer\cd.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\charset_normalizer\md.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\clr_loader\ffi\dlls\amd64\clrloader.dll
  • %TEMP%\_mei000012442\clr_loader\ffi\dlls\x86\clrloader.dll
  • %TEMP%\_mei000012442\crypto\cipher\_arc4.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_chacha20.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_pkcs1_decode.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_aes.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_aesni.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_arc2.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_blowfish.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_cast.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_cbc.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_cfb.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ctr.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_des.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_des3.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ecb.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_eksblowfish.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ocb.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_raw_ofb.pyd
  • %TEMP%\_mei000012442\crypto\cipher\_salsa20.pyd
  • %TEMP%\_mei000012442\crypto\hash\_blake2b.pyd
  • %TEMP%\_mei000012442\crypto\hash\_blake2s.pyd
  • %TEMP%\_mei000012442\crypto\hash\_ghash_clmul.pyd
  • %TEMP%\_mei000012442\crypto\hash\_ghash_portable.pyd
  • %TEMP%\_mei000012442\crypto\hash\_keccak.pyd
  • %TEMP%\_mei000012442\crypto\hash\_md2.pyd
  • %TEMP%\_mei000012442\crypto\hash\_md4.pyd
  • %TEMP%\_mei000012442\crypto\hash\_md5.pyd
  • %TEMP%\_mei000012442\crypto\hash\_poly1305.pyd
  • %TEMP%\_mei000012442\crypto\hash\_ripemd160.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha1.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha224.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha256.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha384.pyd
  • %TEMP%\_mei000012442\crypto\hash\_sha512.pyd
  • %TEMP%\_mei000012442\crypto\math\_modexp.pyd
  • %TEMP%\_mei000012442\crypto\protocol\_scrypt.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_curve25519.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_curve448.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_ec_ws.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_ed25519.pyd
  • %TEMP%\_mei000012442\crypto\publickey\_ed448.pyd
  • %TEMP%\_mei000012442\crypto\util\_cpuid_c.pyd
  • %TEMP%\_mei000012442\crypto\util\_strxor.pyd
  • %TEMP%\_mei000012442\cv2\config-3.py
  • %TEMP%\_mei000012442\cv2\config.py
  • %TEMP%\_mei000012442\cv2\cv2.pyd
  • %TEMP%\_mei000012442\cv2\data\__init__.py
  • %TEMP%\_mei000012442\cv2\load_config_py3.py
  • %TEMP%\_mei000012442\cv2\mat_wrapper\__init__.py
  • %TEMP%\_mei000012442\cv2\misc\version.py
  • %TEMP%\_mei000012442\cv2\misc\__init__.py
  • %TEMP%\_mei000012442\cv2\opencv_videoio_ffmpeg500_64.dll
  • %TEMP%\_mei000012442\cv2\typing\__init__.py
  • %TEMP%\_mei000012442\cv2\utils\__init__.py
  • %TEMP%\_mei000012442\cv2\version.py
  • %TEMP%\_mei000012442\cv2\__init__.py
  • %TEMP%\_mei000012442\libcrypto-3.dll
  • %TEMP%\_mei000012442\libffi-8.dll
  • %TEMP%\_mei000012442\libssl-3.dll
  • %TEMP%\_mei000012442\numpy\fft\_pocketfft_umath.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\bit_generator.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\mtrand.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_bounded_integers.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_common.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_generator.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_mt19937.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_pcg64.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_philox.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\random\_sfc64.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\_core\_multiarray_tests.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\delvewheel
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\entry_points.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\installer
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\fft\pocketfft\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\linalg\lapack_lite\license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\ma\license
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\distributions\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\mt19937\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\pcg64\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\philox\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\sfc64\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\random\src\splitmix64\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\include\numpy\libdivide\license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\common\pythoncapi-compat\copying
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\highway\license
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\multiarray\dragon4_license.txt
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\npysort\x86-simd-sort\license.md
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\licenses\numpy\_core\src\umath\svml\license
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\metadata
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\record
  • %TEMP%\_mei000012442\numpy-2.5.1.dist-info\wheel
  • %TEMP%\_mei000012442\numpy.libs\libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
  • %TEMP%\_mei000012442\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
  • %TEMP%\_mei000012442\pil\_avif.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imaging.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imagingcms.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imagingmath.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_imagingtk.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\pil\_webp.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\psutil\_psutil_windows.pyd
  • %TEMP%\_mei000012442\pyexpat.pyd
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\installer
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\licenses\license.md
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\metadata
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\record
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\top_level.txt
  • %TEMP%\_mei000012442\pyreadline3-3.5.6.dist-info\wheel
  • %TEMP%\_mei000012442\python3.dll
  • %TEMP%\_mei000012442\python314.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\microsoft.win32.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\netstandard.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\python.runtime.deps.json
  • %TEMP%\_mei000012442\pythonnet\runtime\python.runtime.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\python.runtime.xml
  • %TEMP%\_mei000012442\pythonnet\runtime\system.appcontext.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.concurrent.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.nongeneric.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.collections.specialized.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.eventbasedasync.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.componentmodel.typeconverter.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.console.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.data.common.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.contracts.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.debug.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.fileversioninfo.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.process.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.stacktrace.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.textwritertracelistener.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.tools.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.tracesource.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.diagnostics.tracing.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.drawing.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.dynamic.runtime.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.globalization.calendars.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.globalization.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.globalization.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.compression.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.compression.zipfile.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.driveinfo.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.filesystem.watcher.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.isolatedstorage.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.memorymappedfiles.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.pipes.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.io.unmanagedmemorystream.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.expressions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.parallel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.linq.queryable.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.http.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.nameresolution.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.networkinformation.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.ping.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.requests.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.security.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.sockets.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.webheadercollection.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.websockets.client.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.net.websockets.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.objectmodel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.reflection.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.reflection.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.reflection.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.resources.reader.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.resources.resourcemanager.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.resources.writer.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.compilerservices.visualc.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.handles.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.interopservices.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.interopservices.runtimeinformation.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.numerics.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.formatters.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.json.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.runtime.serialization.xml.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.claims.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.algorithms.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.csp.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.encoding.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.primitives.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.cryptography.x509certificates.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.principal.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.security.securestring.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.text.encoding.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.text.encoding.extensions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.text.regularexpressions.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.overlapped.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.tasks.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.tasks.parallel.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.thread.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.threadpool.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.threading.timer.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.valuetuple.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.readerwriter.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xdocument.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xmldocument.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xmlserializer.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xpath.dll
  • %TEMP%\_mei000012442\pythonnet\runtime\system.xml.xpath.xdocument.dll
  • %TEMP%\_mei000012442\pywin32_system32\pywintypes314.dll
  • %TEMP%\_mei000012442\select.pyd
  • %TEMP%\_mei000012442\setuptools\_vendor\jaraco\text\lorem ipsum.txt
  • %TEMP%\_mei000012442\sqlite3.dll
  • %TEMP%\_mei000012442\unicodedata.pyd
  • %TEMP%\_mei000012442\vcruntime140.dll
  • %TEMP%\_mei000012442\vcruntime140_1.dll
  • %TEMP%\_mei000012442\win32\win32api.pyd
  • %TEMP%\_mei000012442\win32\win32crypt.pyd
  • %TEMP%\_mei000012442\win32\win32evtlog.pyd
  • %TEMP%\_mei000012442\win32\win32pdh.pyd
  • %TEMP%\_mei000012442\yaml\_yaml.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\_asyncio.pyd
  • %TEMP%\_mei000012442\_bz2.pyd
  • %TEMP%\_mei000012442\_cffi_backend.cp314-win_amd64.pyd
  • %TEMP%\_mei000012442\_ctypes.pyd
  • %TEMP%\_mei000012442\_decimal.pyd
  • %TEMP%\_mei000012442\_elementtree.pyd
  • %TEMP%\_mei000012442\_hashlib.pyd
  • %TEMP%\_mei000012442\_lzma.pyd
  • %TEMP%\_mei000012442\_multiprocessing.pyd
  • %TEMP%\_mei000012442\_overlapped.pyd
  • %TEMP%\_mei000012442\_queue.pyd
  • %TEMP%\_mei000012442\_socket.pyd
  • %TEMP%\_mei000012442\_sqlite3.pyd
  • %TEMP%\_mei000012442\_ssl.pyd
  • %TEMP%\_mei000012442\_uuid.pyd
  • %TEMP%\_mei000012442\_wmi.pyd
  • %TEMP%\_mei000012442\_zstd.pyd
Moves the following files
  • from %TEMP%\screenshot_1789951830.png to %TEMP%\h4_stash\media\screenshot_1789951830.png
Network activity
Connects to
  • 'ap#.#pify.org':443
  • 'ip##pi.com':80
  • 'di##ord.com':443
TCP
HTTP GET requests
  • http://ip##pi.com/json/Unknown?fi##################################################################################################################
Other
  • 'ap#.#pify.org':443
  • 'di##ord.com':443
UDP
  • DNS ASK ap#.#pify.org
  • DNS ASK ip##pi.com
  • DNS ASK di##ord.com
Miscellaneous
Restarts the analyzed sample
Executes the following
  • '<SYSTEM32>\cmd.exe' /c "ver"
  • '<SYSTEM32>\cmd.exe' /c "netsh wlan show interfaces"
  • '<SYSTEM32>\netsh.exe' wlan show interfaces
  • '<SYSTEM32>\cmd.exe' /c "powershell -Command "(Get-CimInstance Win32_Processor).Name""
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance Win32_Processor).Name"
  • '<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name""
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name"
  • '<SYSTEM32>\cmd.exe' /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
  • '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c "netsh wlan show interfaces"' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c "powershell -Command "(Get-CimInstance Win32_Processor).Name""' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name""' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""' (with hidden window)

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play