Technical Information
- [<HKCU>\software\microsoft\windows\currentversion\run] 'ttWFhNOoez' = 'wscript.exe //B "%APPDATA%\ttWFhNOoez.js"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSSVC.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EMLPROXY.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QUHLPSVC.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAPISSVC.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANNER.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANWSCS.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scproxysrv.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScSecSvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERAntiSpyware.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCore64.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSUpdate64.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERDelete.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASTask.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWatchDog.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiSeAgnt.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAService.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtWatchDog.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMain.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMngr.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanosvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnf.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nbrowser.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nfservice.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwscmon.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\njeeves2.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcod.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprosec.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NS.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twssrv.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreFrameworkHost.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCDBlog.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCHelper64.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmon.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiESNAC.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiProxy.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiSSLVPNdaemon.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiFW.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient_Diagnostic_Tool.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av_task.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CertReg.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilMsg.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilUp.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filwscc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psview.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quamgr.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schmgr.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twsscan.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7SysMon.Exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utsvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreServiceShell.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiUpdateTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIPREUI.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBPIMSvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bavhm.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bav.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavWebClient.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavUpdater.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldCCC.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldRTM.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldDS.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCS-Uninstall.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWelcome.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSvcHost.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebCompanion.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Main.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Svc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Up.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Proxy.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Medic.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BgScan.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuarScanner.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LittleHook.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamscan.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cis.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\software\microsoft\windows\currentversion\run] 'ttWFhNOoez' = 'wscript.exe //B "%APPDATA%\ttWFhNOoez.js"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dWKZgMOPjOs' = '"%APPDATA%\Oracle\bin\javaw.exe" -jar "%HOMEPATH%\rXwDqRVtodJ\iylXOXTCvmX.xJvsrR"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FProtTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKProxy.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDScan.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKService.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDKBFltExe32.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusutilities.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff_x64.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclamwrap.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7FWSrvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7PSSrvc.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7AVScan.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWin.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trigger.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dragon_updater.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CONSCTLX.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanpro.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYSSER.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOS.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIEWTCP.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSHDLL64.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fshoster32.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSMA32.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsorsp.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fssm32.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSM32.EXE] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe] 'debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserReg.exe] 'debugger' = 'svchost.exe'
- %HOMEPATH%\start menu\programs\startup\ttwfhnooez.js
- <Drive name for removable media>:\ttwfhnooez.js
- <Drive name for removable media>:\accountsreceivable.lnk
- <Drive name for removable media>:\writingcompletesarnarrative_1103.lnk
- <Drive name for removable media>:\mappingconcepthubberlin.lnk
- <Drive name for removable media>:\file1.lnk
- <Drive name for removable media>:\arrow-down.lnk
- <Drive name for removable media>:\breakpoint.lnk
- <Drive name for removable media>:\cleanlyrics.lnk
- <Drive name for removable media>:\asm.lnk
- <Drive name for removable media>:\calibre.lnk
- <Drive name for removable media>:\systisoft.lnk
- <Drive name for removable media>:\cert.lnk
- <Drive name for removable media>:\proposaltemplates.lnk
- <Drive name for removable media>:\irgeek.lnk
- <Drive name for removable media>:\tunpersonalca1.lnk
- <Drive name for removable media>:\hhhlcert.lnk
- <Drive name for removable media>:\investmentbankca_ca8.lnk
- <Drive name for removable media>:\ff_ot_user_guide.lnk
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.lnk
- <Drive name for removable media>:\lom602.lnk
- <Drive name for removable media>:\bc01.lnk
- <Drive name for removable media>:\10thingscondoms.lnk
- <Drive name for removable media>:\fil_20060629111052.lnk
- <Drive name for removable media>:\7790_preview.lnk
- <Drive name for removable media>:\dualectls.lnk
- <Drive name for removable media>:\delongcacert.lnk
- <Drive name for removable media>:\babyboymaintoscenesbackground_pal.lnk
- <Drive name for removable media>:\price.lnk
- <Drive name for removable media>:\stoc13_ml_quoc_le.lnk
- <Drive name for removable media>:\2013_finalsummaryforweb.lnk
- <Drive name for removable media>:\highly_cited_2001.lnk
- <Drive name for removable media>:\2013_smccc_competition_points_jul2013.lnk
- <Drive name for removable media>:\suspendedcompanies.lnk
- <Drive name for removable media>:\trtf_matrix2012_oct.lnk
- <Drive name for removable media>:\price030215.lnk
- <Drive name for removable media>:\subjectclassification.lnk
- <Drive name for removable media>:\excel_example.lnk
- <Drive name for removable media>:\1sm_price.lnk
- <Drive name for removable media>:\productos.lnk
- <Drive name for removable media>:\passport_pal.lnk
- <Drive name for removable media>:\spib_pima.lnk
- <Drive name for removable media>:\testwmv.lnk
- <Drive name for removable media>:\flower_trans_matte.lnk
- <Drive name for removable media>:\babyboymaintonotesbackground_pal.lnk
- <Drive name for removable media>:\babyboymaintoscenesbackground.lnk
- <Drive name for removable media>:\pubnet_855.lnk
- <Drive name for removable media>:\phytoremediation.lnk
- <Drive name for removable media>:\static_electricity_easy_and_quick_activities.lnk
- <Drive name for removable media>:\myhrvoldhanssenbiharfamine.lnk
- <Drive name for removable media>:\swc_2009-03-02.lnk
- <Drive name for removable media>:\schema.lnk
- <Drive name for removable media>:\middaugh_keynote.lnk
- <Drive name for removable media>:\samieee_obiee_presentation.lnk
- <Drive name for removable media>:\asaprojectcompetition.lnk
- <Drive name for removable media>:\roozenedowebinar.lnk
- <Drive name for removable media>:\51.lnk
- <Drive name for removable media>:\file_p_00000000_1371597592.lnk
- <Drive name for removable media>:\thlps_keeper_mayer_1965.lnk
- <Drive name for removable media>:\sdszfo.lnk
- <Drive name for removable media>:\cveuropeo.lnk
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.lnk
- <Drive name for removable media>:\hanni_umami_chapter.lnk
- <Drive name for removable media>:\fi51.lnk
- <Drive name for removable media>:\508softwareandos.lnk
- <Drive name for removable media>:\weeklysheet1215.lnk
- <Drive name for removable media>:\ovp25012015.lnk
- <Drive name for removable media>:\contoso.lnk
- <Drive name for removable media>:\sdksampleprivdeveloper.lnk
- <Drive name for removable media>:\glidescope_review_rev_010.lnk
- <Drive name for removable media>:\sdkfailsafeemulator.lnk
- <Drive name for removable media>:\contoso_1.lnk
- <Drive name for removable media>:\pmd.lnk
- <Drive name for removable media>:\dial.lnk
- <Drive name for removable media>:\default.lnk
- <Drive name for removable media>:\dashborder_192.lnk
- <Drive name for removable media>:\coffee.lnk
- <Drive name for removable media>:\join.lnk
- <Drive name for removable media>:\archer.lnk
- <Drive name for removable media>:\000814251_video_01.lnk
- <Drive name for removable media>:\delete.lnk
- <Drive name for removable media>:\correct.lnk
- <Drive name for removable media>:\contosoroot.lnk
- <Drive name for removable media>:\alert.lnk
- <Drive name for removable media>:\dag2_panel1_320_ref.lnk
- <Drive name for removable media>:\holycrosschurchinstructions.lnk
- <Drive name for removable media>:\spanner.lnk
- <Drive name for removable media>:\firefly1.lnk
- <Drive name for removable media>:\2.lnk
- <Drive name for removable media>:\1189.lnk
- <Drive name for removable media>:\168.lnk
- <Drive name for removable media>:\region-north-karelia.lnk
- <Drive name for removable media>:\3.lnk
- <Drive name for removable media>:\4f0bf7ff71f28.lnk
- <Drive name for removable media>:\13.lnk
- <Drive name for removable media>:\pushkin.lnk
- <Drive name for removable media>:\parnas_01.lnk
- <Drive name for removable media>:\clip_480_5sec_6mbps_h264.lnk
- <Drive name for removable media>:\adadsi.lnk
- <Drive name for removable media>:\tree_view.lnk
- <Drive name for removable media>:\howto-index.lnk
- <Drive name for removable media>:\api-hashmap.lnk
- <Drive name for removable media>:\iisstart.lnk
- <Drive name for removable media>:\trivial-merge.lnk
- <Drive name for removable media>:\ituneshelpunavailable.lnk
- <Drive name for removable media>:\browse.lnk
- <Drive name for removable media>:\garden.lnk
- <Drive name for removable media>:\skypesetup.lnk
- <Drive name for removable media>:\tcm851ax32.lnk
- <Drive name for removable media>:\chromesetup.lnk
- <Drive name for removable media>:\adhd_and_obesity.lnk
- <Drive name for removable media>:\calculatorworksheet.lnk
- Windows Task Manager (Taskmgr)
- System Restore (SR)
- User Account Control (UAC)
- '%APPDATA%\oracle\bin\javaw.exe' -jar "%HOMEPATH%\rXwDqRVtodJ\iylXOXTCvmX.xJvsrR"
- '%APPDATA%\oracle\bin\java.exe' -jar %TEMP%\_0.60721384903874544506370095928512016.class
- '<SYSTEM32>\taskkill.exe' /IM UserAccountControlSettings.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM BullGuardUpdate.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM clamscan.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM ClamTray.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM ClamWin.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM cis.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM CisTray.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM cmdagent.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM cavwp.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM dragon_updater.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM MWAGENT.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM MWASER.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM CONSCTLX.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM avpmapp.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM dumpcap.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM econceal.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM escanpro.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM TRAYSSER.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM TRAYICOS.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM econser.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM VIEWTCP.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM FSHDLL64.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM fsgk32.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM fshoster32.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM FSMA32.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM fsorsp.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM fssm32.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM FSM32.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM trigger.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM BullGuarScanner.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM LittleHook.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM BullGuardBhvScanner.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM BullGuard.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM BgScan.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM ProcessHacker.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM procexp.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM MSASCui.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM MsMpEng.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM MpUXSrv.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM MpCmdRun.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM NisSrv.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM ConfigSecurityPolicy.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM wireshark.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM tshark.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM text2pcap.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM rawshark.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM mergecap.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM FProtTray.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM escanmon.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM editcap.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM mbam.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM mbamscheduler.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM mbamservice.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM AdAwareService.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM AdAwareTray.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM WebCompanion.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM AdAwareDesktop.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM V3Main.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM V3Svc.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM V3Up.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM V3SP.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM V3Proxy.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM V3Medic.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM Taskmgr.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM capinfos.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM FPWin.exe /T /F
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\xcopy.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;....
- %APPDATA%\ttwfhnooez.js
- %APPDATA%\oracle\lib\zi\asia\hovd
- %APPDATA%\oracle\lib\zi\asia\ho_chi_minh
- %APPDATA%\oracle\lib\zi\asia\irkutsk
- %APPDATA%\oracle\lib\zi\asia\jakarta
- %APPDATA%\oracle\lib\zi\asia\jayapura
- %APPDATA%\oracle\lib\zi\asia\jerusalem
- %APPDATA%\oracle\lib\zi\asia\hebron
- %APPDATA%\oracle\lib\zi\asia\hong_kong
- %APPDATA%\oracle\lib\zi\asia\kabul
- %APPDATA%\oracle\lib\zi\asia\kashgar
- %APPDATA%\oracle\lib\zi\asia\kathmandu
- %APPDATA%\oracle\lib\zi\asia\kolkata
- %APPDATA%\oracle\lib\zi\asia\krasnoyarsk
- %APPDATA%\oracle\lib\zi\asia\kuala_lumpur
- %APPDATA%\oracle\lib\zi\asia\kuching
- %APPDATA%\oracle\lib\zi\asia\kamchatka
- %APPDATA%\oracle\lib\zi\asia\karachi
- %APPDATA%\oracle\lib\zi\asia\macau
- %APPDATA%\oracle\lib\zi\asia\kuwait
- %APPDATA%\oracle\lib\zi\asia\dushanbe
- %APPDATA%\oracle\lib\zi\asia\baghdad
- %APPDATA%\oracle\lib\zi\asia\bahrain
- %APPDATA%\oracle\lib\zi\asia\baku
- %APPDATA%\oracle\lib\zi\asia\bangkok
- %APPDATA%\oracle\lib\zi\asia\beirut
- %APPDATA%\oracle\lib\zi\asia\gaza
- %APPDATA%\oracle\lib\zi\asia\aqtobe
- %APPDATA%\oracle\lib\zi\asia\harbin
- %APPDATA%\oracle\lib\zi\asia\bishkek
- %APPDATA%\oracle\lib\zi\asia\colombo
- %APPDATA%\oracle\lib\zi\asia\damascus
- %APPDATA%\oracle\lib\zi\asia\dhaka
- %APPDATA%\oracle\lib\zi\asia\dili
- %APPDATA%\oracle\lib\zi\asia\dubai
- %APPDATA%\oracle\lib\zi\asia\brunei
- %APPDATA%\oracle\lib\zi\asia\choibalsan
- %APPDATA%\oracle\lib\zi\asia\chongqing
- %APPDATA%\oracle\lib\zi\asia\amman
- %APPDATA%\oracle\lib\zi\asia\magadan
- %APPDATA%\oracle\lib\zi\asia\singapore
- %APPDATA%\oracle\lib\zi\asia\tashkent
- %APPDATA%\oracle\lib\zi\asia\tbilisi
- %APPDATA%\oracle\lib\zi\asia\tehran
- %APPDATA%\oracle\lib\zi\asia\thimphu
- %APPDATA%\oracle\lib\zi\asia\tokyo
- %APPDATA%\oracle\lib\zi\asia\shanghai
- %APPDATA%\oracle\lib\zi\asia\ulaanbaatar
- %APPDATA%\oracle\lib\zi\asia\taipei
- %APPDATA%\oracle\lib\zi\asia\vientiane
- %APPDATA%\oracle\lib\zi\asia\yakutsk
- %APPDATA%\oracle\lib\zi\asia\yekaterinburg
- %APPDATA%\oracle\lib\zi\asia\yerevan
- %APPDATA%\oracle\lib\zi\atlantic\azores
- %APPDATA%\oracle\lib\zi\atlantic\bermuda
- %APPDATA%\oracle\lib\zi\asia\urumqi
- %APPDATA%\oracle\lib\zi\asia\seoul
- %APPDATA%\oracle\lib\zi\asia\vladivostok
- %APPDATA%\oracle\lib\zi\asia\samarkand
- %APPDATA%\oracle\lib\zi\asia\sakhalin
- %APPDATA%\oracle\lib\zi\asia\manila
- %APPDATA%\oracle\lib\zi\asia\nicosia
- %APPDATA%\oracle\lib\zi\asia\novokuznetsk
- %APPDATA%\oracle\lib\zi\asia\novosibirsk
- %APPDATA%\oracle\lib\zi\asia\omsk
- %APPDATA%\oracle\lib\zi\asia\oral
- %APPDATA%\oracle\lib\zi\asia\phnom_penh
- %APPDATA%\oracle\lib\zi\asia\pontianak
- %APPDATA%\oracle\lib\zi\asia\muscat
- %APPDATA%\oracle\lib\zi\asia\pyongyang
- %APPDATA%\oracle\lib\zi\asia\qyzylorda
- %APPDATA%\oracle\lib\zi\asia\rangoon
- %APPDATA%\oracle\lib\zi\asia\riyadh
- %APPDATA%\oracle\lib\zi\asia\riyadh87
- %APPDATA%\oracle\lib\zi\asia\riyadh88
- %APPDATA%\oracle\lib\zi\asia\riyadh89
- %APPDATA%\oracle\lib\zi\asia\aqtau
- %APPDATA%\oracle\lib\zi\asia\qatar
- %APPDATA%\oracle\lib\zi\asia\ashgabat
- %APPDATA%\oracle\lib\zi\asia\anadyr
- %APPDATA%\oracle\lib\zi\asia\almaty
- %APPDATA%\oracle\lib\zi\atlantic\cape_verde
- %APPDATA%\oracle\lib\zi\america\sitka
- %APPDATA%\oracle\lib\zi\america\st_johns
- %APPDATA%\oracle\lib\zi\america\st_kitts
- %APPDATA%\oracle\lib\zi\america\st_lucia
- %APPDATA%\oracle\lib\zi\america\santiago
- %APPDATA%\oracle\lib\zi\america\st_thomas
- %APPDATA%\oracle\lib\zi\america\swift_current
- %APPDATA%\oracle\lib\zi\america\scoresbysund
- %APPDATA%\oracle\lib\zi\america\tegucigalpa
- %APPDATA%\oracle\lib\zi\america\thunder_bay
- %APPDATA%\oracle\lib\zi\america\tijuana
- %APPDATA%\oracle\lib\zi\america\toronto
- %APPDATA%\oracle\lib\zi\america\tortola
- %APPDATA%\oracle\lib\zi\america\st_vincent
- %APPDATA%\oracle\lib\zi\america\santa_isabel
- %APPDATA%\oracle\lib\zi\atlantic\canary
- %APPDATA%\oracle\lib\zi\america\thule
- %APPDATA%\oracle\lib\zi\america\sao_paulo
- %APPDATA%\oracle\lib\zi\america\santarem
- %APPDATA%\oracle\lib\zi\america\rio_branco
- %APPDATA%\oracle\lib\zi\america\ojinaga
- %APPDATA%\oracle\lib\zi\america\panama
- %APPDATA%\oracle\lib\zi\america\pangnirtung
- %APPDATA%\oracle\lib\zi\america\paramaribo
- %APPDATA%\oracle\lib\zi\america\phoenix
- %APPDATA%\oracle\lib\zi\america\port-au-prince
- %APPDATA%\oracle\lib\zi\america\nome
- %APPDATA%\oracle\lib\zi\america\porto_velho
- %APPDATA%\oracle\lib\zi\america\puerto_rico
- %APPDATA%\oracle\lib\zi\america\rainy_river
- %APPDATA%\oracle\lib\zi\america\rankin_inlet
- %APPDATA%\oracle\lib\zi\america\recife
- %APPDATA%\oracle\lib\zi\america\regina
- %APPDATA%\oracle\lib\zi\america\resolute
- %APPDATA%\oracle\lib\zi\america\vancouver
- %APPDATA%\oracle\lib\zi\america\port_of_spain
- %APPDATA%\oracle\lib\zi\america\nipigon
- %APPDATA%\oracle\lib\zi\america\santo_domingo
- %APPDATA%\oracle\lib\zi\asia\makassar
- %APPDATA%\oracle\lib\zi\america\whitehorse
- %APPDATA%\oracle\lib\zi\america\argentina\catamarca
- %APPDATA%\oracle\lib\zi\america\north_dakota\center
- %APPDATA%\oracle\lib\zi\america\north_dakota\new_salem
- %APPDATA%\oracle\lib\zi\antarctica\casey
- %APPDATA%\oracle\lib\zi\antarctica\davis
- %APPDATA%\oracle\lib\zi\america\indiana\winamac
- %APPDATA%\oracle\lib\zi\antarctica\dumontdurville
- %APPDATA%\oracle\lib\zi\antarctica\mawson
- %APPDATA%\oracle\lib\zi\america\north_dakota\beulah
- %APPDATA%\oracle\lib\zi\antarctica\mcmurdo
- %APPDATA%\oracle\lib\zi\antarctica\rothera
- %APPDATA%\oracle\lib\zi\antarctica\syowa
- %APPDATA%\oracle\lib\zi\antarctica\vostok
- %APPDATA%\oracle\lib\zi\asia\aden
- %APPDATA%\oracle\lib\zi\antarctica\macquarie
- %APPDATA%\oracle\lib\zi\america\indiana\vincennes
- %APPDATA%\oracle\lib\zi\america\yakutat
- %APPDATA%\oracle\lib\zi\antarctica\palmer
- %APPDATA%\oracle\lib\zi\america\kentucky\monticello
- %APPDATA%\oracle\lib\zi\america\indiana\vevay
- %APPDATA%\oracle\lib\zi\america\indiana\tell_city
- %APPDATA%\oracle\lib\zi\america\argentina\cordoba
- %APPDATA%\oracle\lib\zi\america\argentina\jujuy
- %APPDATA%\oracle\lib\zi\america\argentina\la_rioja
- %APPDATA%\oracle\lib\zi\america\argentina\mendoza
- %APPDATA%\oracle\lib\zi\america\argentina\rio_gallegos
- %APPDATA%\oracle\lib\zi\america\argentina\salta
- %APPDATA%\oracle\lib\zi\america\argentina\buenos_aires
- %APPDATA%\oracle\lib\zi\america\argentina\san_juan
- %APPDATA%\oracle\lib\zi\america\argentina\tucuman
- %APPDATA%\oracle\lib\zi\america\argentina\ushuaia
- %APPDATA%\oracle\lib\zi\america\indiana\indianapolis
- %APPDATA%\oracle\lib\zi\america\indiana\knox
- %APPDATA%\oracle\lib\zi\america\indiana\marengo
- %APPDATA%\oracle\lib\zi\america\indiana\petersburg
- %APPDATA%\oracle\lib\zi\america\winnipeg
- %APPDATA%\oracle\lib\zi\america\argentina\san_luis
- %APPDATA%\oracle\lib\zi\america\yellowknife
- %APPDATA%\oracle\lib\zi\america\kentucky\louisville
- %APPDATA%\oracle\lib\zi\africa\algiers
- %APPDATA%\oracle\lib\zi\atlantic\faroe
- %APPDATA%\oracle\lib\zi\pacific\easter
- %APPDATA%\oracle\lib\zi\pacific\enderbury
- %APPDATA%\oracle\lib\zi\pacific\fakaofo
- %APPDATA%\oracle\lib\zi\pacific\fiji
- %APPDATA%\oracle\lib\zi\pacific\funafuti
- %APPDATA%\oracle\lib\zi\pacific\galapagos
- %APPDATA%\oracle\lib\zi\pacific\chuuk
- %APPDATA%\oracle\lib\zi\pacific\gambier
- %APPDATA%\oracle\lib\zi\pacific\efate
- %APPDATA%\oracle\lib\zi\pacific\guam
- %APPDATA%\oracle\lib\zi\pacific\johnston
- %APPDATA%\oracle\lib\zi\pacific\kiritimati
- %APPDATA%\oracle\lib\zi\pacific\kosrae
- %APPDATA%\oracle\lib\zi\pacific\kwajalein
- %APPDATA%\oracle\lib\zi\pacific\majuro
- %APPDATA%\oracle\lib\zi\pacific\guadalcanal
- %APPDATA%\oracle\lib\zi\pacific\chatham
- %APPDATA%\oracle\lib\zi\pacific\honolulu
- %APPDATA%\oracle\lib\zi\pacific\auckland
- %APPDATA%\oracle\lib\zi\pacific\apia
- %APPDATA%\oracle\lib\zi\europe\vienna
- %APPDATA%\oracle\lib\zi\europe\volgograd
- %APPDATA%\oracle\lib\zi\europe\warsaw
- %APPDATA%\oracle\lib\zi\europe\zaporozhye
- %APPDATA%\oracle\lib\zi\europe\zurich
- %APPDATA%\oracle\lib\zi\indian\antananarivo
- %APPDATA%\oracle\lib\zi\indian\chagos
- %APPDATA%\oracle\lib\zi\indian\christmas
- %APPDATA%\oracle\lib\zi\europe\vilnius
- %APPDATA%\oracle\lib\zi\indian\cocos
- %APPDATA%\oracle\lib\zi\indian\kerguelen
- %APPDATA%\oracle\lib\zi\indian\mahe
- %APPDATA%\oracle\lib\zi\indian\maldives
- %APPDATA%\oracle\lib\zi\indian\mauritius
- %APPDATA%\oracle\lib\zi\indian\mayotte
- %APPDATA%\oracle\lib\zi\indian\reunion
- %APPDATA%\oracle\lib\zi\pacific\marquesas
- %APPDATA%\oracle\lib\zi\indian\comoro
- %APPDATA%\oracle\lib\zi\europe\vaduz
- %APPDATA%\oracle\lib\zi\america\new_york
- %APPDATA%\oracle\lib\zi\europe\uzhgorod
- %APPDATA%\oracle\lib\zi\systemv\mst7
- %APPDATA%\oracle\lib\zi\systemv\pst8
- %APPDATA%\oracle\lib\zi\systemv\pst8pdt
- %APPDATA%\oracle\lib\zi\systemv\yst9
- %APPDATA%\oracle\lib\zi\systemv\yst9ydt
- <SYSTEM32>\test.txt
- %APPDATA%\oracle\lib\zi\systemv\hst10
- %HOMEPATH%\rxwdqrvtodj\id.txt
- %APPDATA%\oracle\lib\zi\systemv\mst7mdt
- %TEMP%\hsperfdata_user\372
- %TEMP%\hsperfdata_user\1872
- %TEMP%\retrive8867415420781598799.vbs
- %TEMP%\retrive9185351570996083359.vbs
- %TEMP%\retrive6181063479674248693.vbs
- %TEMP%\retrive2104408020047118759.vbs
- %HOMEPATH%\rxwdqrvtodj\iylxoxtcvmx.xjvsrr
- %APPDATA%\oracle\lib\zi\systemv\est5edt
- %TEMP%\_0.60721384903874544506370095928512016.class
- %APPDATA%\oracle\lib\zi\systemv\est5
- %APPDATA%\oracle\lib\zi\systemv\cst6cdt
- %APPDATA%\oracle\lib\zi\pacific\norfolk
- %APPDATA%\oracle\lib\zi\pacific\pago_pago
- %APPDATA%\oracle\lib\zi\pacific\palau
- %APPDATA%\oracle\lib\zi\pacific\pitcairn
- %APPDATA%\oracle\lib\zi\pacific\pohnpei
- %APPDATA%\oracle\lib\zi\pacific\port_moresby
- %APPDATA%\oracle\lib\zi\pacific\rarotonga
- %APPDATA%\oracle\lib\zi\pacific\saipan
- %APPDATA%\oracle\lib\zi\pacific\noumea
- %APPDATA%\oracle\lib\zi\pacific\tahiti
- %APPDATA%\oracle\lib\zi\pacific\tongatapu
- %APPDATA%\oracle\lib\zi\pacific\wake
- %APPDATA%\oracle\lib\zi\pacific\wallis
- %APPDATA%\oracle\lib\zi\systemv\ast4
- %APPDATA%\oracle\lib\zi\systemv\ast4adt
- %APPDATA%\oracle\lib\zi\systemv\cst6
- %APPDATA%\oracle\lib\zi\pacific\nauru
- %APPDATA%\oracle\lib\zi\pacific\tarawa
- %APPDATA%\oracle\lib\zi\pacific\midway
- %APPDATA%\oracle\lib\zi\america\noronha
- %APPDATA%\oracle\lib\zi\europe\tallinn
- %APPDATA%\oracle\lib\zi\etc\gmt-7
- %APPDATA%\oracle\lib\zi\etc\gmt+4
- %APPDATA%\oracle\lib\zi\etc\gmt+5
- %APPDATA%\oracle\lib\zi\etc\gmt+6
- %APPDATA%\oracle\lib\zi\etc\gmt+7
- %APPDATA%\oracle\lib\zi\etc\gmt+8
- %APPDATA%\oracle\lib\zi\etc\gmt+12
- %APPDATA%\oracle\lib\zi\etc\gmt+9
- %APPDATA%\oracle\lib\zi\etc\gmt+3
- %APPDATA%\oracle\lib\zi\etc\gmt-10
- %APPDATA%\oracle\lib\zi\etc\gmt-12
- %APPDATA%\oracle\lib\zi\etc\gmt-13
- %APPDATA%\oracle\lib\zi\etc\gmt-14
- %APPDATA%\oracle\lib\zi\etc\gmt-2
- %APPDATA%\oracle\lib\zi\etc\gmt-3
- %APPDATA%\oracle\lib\zi\etc\gmt-1
- %APPDATA%\oracle\lib\zi\etc\gmt+11
- %APPDATA%\oracle\lib\zi\etc\gmt-11
- %APPDATA%\oracle\lib\zi\etc\gmt+10
- %APPDATA%\oracle\lib\zi\etc\gmt+1
- %APPDATA%\oracle\lib\zi\atlantic\reykjavik
- %APPDATA%\oracle\lib\zi\atlantic\stanley
- %APPDATA%\oracle\lib\zi\atlantic\st_helena
- %APPDATA%\oracle\lib\zi\australia\adelaide
- %APPDATA%\oracle\lib\zi\australia\brisbane
- %APPDATA%\oracle\lib\zi\australia\broken_hill
- %APPDATA%\oracle\lib\zi\australia\currie
- %APPDATA%\oracle\lib\zi\australia\darwin
- %APPDATA%\oracle\lib\zi\atlantic\south_georgia
- %APPDATA%\oracle\lib\zi\australia\eucla
- %APPDATA%\oracle\lib\zi\australia\lindeman
- %APPDATA%\oracle\lib\zi\australia\lord_howe
- %APPDATA%\oracle\lib\zi\australia\melbourne
- %APPDATA%\oracle\lib\zi\australia\perth
- %APPDATA%\oracle\lib\zi\australia\sydney
- %APPDATA%\oracle\lib\zi\etc\gmt
- %APPDATA%\oracle\lib\zi\etc\gmt-4
- %APPDATA%\oracle\lib\zi\australia\hobart
- %APPDATA%\oracle\lib\zi\europe\tirane
- %APPDATA%\oracle\lib\zi\atlantic\madeira
- %APPDATA%\oracle\lib\zi\etc\gmt+2
- %APPDATA%\oracle\lib\zi\europe\london
- %APPDATA%\oracle\lib\zi\europe\madrid
- %APPDATA%\oracle\lib\zi\europe\malta
- %APPDATA%\oracle\lib\zi\europe\minsk
- %APPDATA%\oracle\lib\zi\europe\monaco
- %APPDATA%\oracle\lib\zi\europe\moscow
- %APPDATA%\oracle\lib\zi\europe\lisbon
- %APPDATA%\oracle\lib\zi\europe\oslo
- %APPDATA%\oracle\lib\zi\europe\luxembourg
- %APPDATA%\oracle\lib\zi\europe\prague
- %APPDATA%\oracle\lib\zi\europe\rome
- %APPDATA%\oracle\lib\zi\europe\samara
- %APPDATA%\oracle\lib\zi\europe\simferopol
- %APPDATA%\oracle\lib\zi\europe\sofia
- %APPDATA%\oracle\lib\zi\europe\stockholm
- %APPDATA%\oracle\lib\zi\europe\paris
- %APPDATA%\oracle\lib\zi\europe\kiev
- %APPDATA%\oracle\lib\zi\europe\riga
- %APPDATA%\oracle\lib\zi\europe\kaliningrad
- %APPDATA%\oracle\lib\zi\europe\istanbul
- %APPDATA%\oracle\lib\zi\etc\gmt-8
- %APPDATA%\oracle\lib\zi\etc\uct
- %APPDATA%\oracle\lib\zi\etc\utc
- %APPDATA%\oracle\lib\zi\europe\amsterdam
- %APPDATA%\oracle\lib\zi\europe\andorra
- %APPDATA%\oracle\lib\zi\europe\athens
- %APPDATA%\oracle\lib\zi\europe\belgrade
- %APPDATA%\oracle\lib\zi\europe\berlin
- %APPDATA%\oracle\lib\zi\etc\gmt-9
- %APPDATA%\oracle\lib\zi\europe\brussels
- %APPDATA%\oracle\lib\zi\europe\budapest
- %APPDATA%\oracle\lib\zi\europe\chisinau
- %APPDATA%\oracle\lib\zi\europe\copenhagen
- %APPDATA%\oracle\lib\zi\europe\dublin
- %APPDATA%\oracle\lib\zi\europe\gibraltar
- %APPDATA%\oracle\lib\zi\europe\helsinki
- %APPDATA%\oracle\lib\zi\etc\gmt-6
- %APPDATA%\oracle\lib\zi\europe\bucharest
- %APPDATA%\oracle\lib\zi\etc\gmt-5
- %APPDATA%\oracle\lib\zi\america\nassau
- %APPDATA%\oracle\lib\zi\america\montserrat
- %APPDATA%\oracle\lib\zi\america\montreal
- %APPDATA%\oracle\lib\fontconfig.properties.src
- %APPDATA%\oracle\lib\javaws.jar
- %APPDATA%\oracle\lib\jce.jar
- %APPDATA%\oracle\lib\jsse.jar
- %APPDATA%\oracle\lib\flavormap.properties
- %APPDATA%\oracle\lib\jvm.hprof.txt
- %APPDATA%\oracle\lib\management-agent.jar
- %APPDATA%\oracle\lib\fontconfig.bfc
- %APPDATA%\oracle\lib\meta-index
- %APPDATA%\oracle\lib\plugin.jar
- %APPDATA%\oracle\lib\psfont.properties.ja
- %APPDATA%\oracle\lib\psfontj2d.properties
- %APPDATA%\oracle\lib\resources.jar
- %APPDATA%\oracle\lib\logging.properties
- %APPDATA%\oracle\lib\deploy.jar
- %APPDATA%\oracle\bin\sunmscapi.dll
- %APPDATA%\oracle\lib\net.properties
- %APPDATA%\oracle\lib\fontconfig.98.properties.src
- %APPDATA%\oracle\lib\content-types.properties
- %APPDATA%\oracle\lib\classlist
- %APPDATA%\oracle\bin\unpack200.exe
- %APPDATA%\oracle\bin\verify.dll
- %APPDATA%\oracle\bin\w2k_lsa_auth.dll
- %APPDATA%\oracle\bin\wsdetect.dll
- %APPDATA%\oracle\bin\zip.dll
- %APPDATA%\oracle\bin\client\classes.jsa
- %APPDATA%\oracle\bin\unicows.dll
- %APPDATA%\oracle\bin\client\jvm.dll
- %APPDATA%\oracle\bin\dtplugin\deployjava1.dll
- %APPDATA%\oracle\bin\dtplugin\npdeployjava1.dll
- %APPDATA%\oracle\bin\plugin2\msvcr71.dll
- %APPDATA%\oracle\bin\plugin2\npjp2.dll
- %APPDATA%\oracle\lib\calendars.properties
- %APPDATA%\oracle\lib\charsets.jar
- %APPDATA%\oracle\lib\rt.jar
- %APPDATA%\oracle\bin\client\xusage.txt
- %APPDATA%\oracle\bin\tnameserv.exe
- %APPDATA%\oracle\bin\jdbcodbc.dll
- %APPDATA%\oracle\bin\unpack.dll
- %APPDATA%\oracle\lib\sound.properties
- %APPDATA%\oracle\lib\cmm\linear_rgb.pf
- %APPDATA%\oracle\lib\deploy\jqs\ff\chrome\content\overlay.js
- %APPDATA%\oracle\lib\deploy\jqs\ff\chrome\content\overlay.xul
- %APPDATA%\oracle\lib\deploy\jqs\ie\jqs_plugin.dll
- %APPDATA%\oracle\lib\ext\dnsns.jar
- %APPDATA%\oracle\lib\deploy\jqs\jqs.conf
- %APPDATA%\oracle\lib\ext\localedata.jar
- %APPDATA%\oracle\lib\ext\sunjce_provider.jar
- %APPDATA%\oracle\lib\deploy\jqs\ff\install.rdf
- %APPDATA%\oracle\lib\ext\sunmscapi.jar
- %APPDATA%\oracle\lib\fonts\lucidabrightdemibold.ttf
- %APPDATA%\oracle\lib\fonts\lucidabrightdemiitalic.ttf
- %APPDATA%\oracle\lib\fonts\lucidabrightitalic.ttf
- %APPDATA%\oracle\lib\fonts\lucidabrightregular.ttf
- %APPDATA%\oracle\lib\ext\meta-index
- %APPDATA%\oracle\lib\deploy\splash.gif
- %APPDATA%\oracle\lib\audio\soundbank.gm
- %APPDATA%\oracle\lib\ext\sunpkcs11.jar
- %APPDATA%\oracle\lib\deploy\jqs\ff\chrome.manifest
- %APPDATA%\oracle\lib\deploy\messages_zh_tw.properties
- %APPDATA%\oracle\lib\deploy\messages_zh_hk.properties
- %APPDATA%\oracle\lib\cmm\pycc.pf
- %APPDATA%\oracle\lib\cmm\srgb.pf
- %APPDATA%\oracle\lib\deploy\ffjcext.zip
- %APPDATA%\oracle\lib\deploy\lzma.dll
- %APPDATA%\oracle\lib\deploy\messages.properties
- %APPDATA%\oracle\lib\deploy\messages_de.properties
- %APPDATA%\oracle\lib\cmm\gray.pf
- %APPDATA%\oracle\lib\deploy\messages_es.properties
- %APPDATA%\oracle\lib\deploy\messages_it.properties
- %APPDATA%\oracle\lib\deploy\messages_ja.properties
- %APPDATA%\oracle\lib\deploy\messages_ko.properties
- %APPDATA%\oracle\lib\deploy\messages_pt_br.properties
- %APPDATA%\oracle\lib\deploy\messages_sv.properties
- %APPDATA%\oracle\lib\deploy\messages_zh_cn.properties
- %APPDATA%\oracle\lib\tzmappings
- %APPDATA%\oracle\lib\deploy\messages_fr.properties
- %APPDATA%\oracle\lib\cmm\ciexyz.pf
- %APPDATA%\oracle\lib\deploy\jqs\jqsmessages.properties
- %HOMEPATH%\futkaleatxm\id.txt
- %APPDATA%\oracle\lib\fonts\lucidasansdemibold.ttf
- %APPDATA%\oracle\bin\splashscreen.dll
- %APPDATA%\oracle\bin\hprof.dll
- %APPDATA%\oracle\bin\instrument.dll
- %APPDATA%\oracle\bin\ioser12.dll
- %APPDATA%\oracle\bin\j2pcsc.dll
- %APPDATA%\oracle\bin\j2pkcs11.dll
- %APPDATA%\oracle\bin\eula.dll
- %APPDATA%\oracle\bin\dt_shmem.dll
- %APPDATA%\oracle\bin\hpi.dll
- %APPDATA%\oracle\bin\jaas_nt.dll
- %APPDATA%\oracle\bin\javacpl.cpl
- %APPDATA%\oracle\bin\javacpl.exe
- %APPDATA%\oracle\bin\javaw.exe
- %APPDATA%\oracle\bin\javaws.exe
- %APPDATA%\oracle\bin\java_crw_demo.dll
- %APPDATA%\oracle\bin\java-rmi.exe
- %APPDATA%\oracle\bin\java.dll
- %APPDATA%\oracle\bin\java.exe
- %APPDATA%\oracle\bin\dt_socket.dll
- %APPDATA%\oracle\bin\deploy.dll
- %APPDATA%\oracle\bin\jawt.dll
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1229272821-842925246-1060284298-1003\83aa4cc77f591dfc2374580bbd95f6ba_5f9fe710-99e6-4c04-be62-a7f1b8b321d1
- %TEMP%\_0.186665152814548984826134752243501667.class
- %TEMP%\retrive7354408981700992121.vbs
- %TEMP%\retrive3792692243016155524.vbs
- %TEMP%\retrive5580411698521728140.vbs
- %TEMP%\retrive3314857813702778942.vbs
- %APPDATA%\oracle\copyright
- %APPDATA%\jupsiy.txt
- %APPDATA%\oracle\license
- %APPDATA%\oracle\readme.txt
- %APPDATA%\oracle\thirdpartylicensereadme.txt
- %APPDATA%\oracle\welcome.html
- %APPDATA%\oracle\bin\awt.dll
- %APPDATA%\oracle\bin\axbridge.dll
- %APPDATA%\oracle\bin\cmm.dll
- %APPDATA%\oracle\bin\dcpr.dll
- %APPDATA%\oracle\license.txt
- %APPDATA%\oracle\bin\ssv.dll
- %APPDATA%\oracle\bin\ssvagent.exe
- %APPDATA%\oracle\bin\jbroker.exe
- %APPDATA%\oracle\bin\jli.dll
- %APPDATA%\oracle\bin\msvcrt.dll
- %APPDATA%\oracle\bin\net.dll
- %APPDATA%\oracle\bin\nio.dll
- %APPDATA%\oracle\bin\npjpi160_45.dll
- %APPDATA%\oracle\bin\npoji610.dll
- %APPDATA%\oracle\bin\management.dll
- %APPDATA%\oracle\bin\npt.dll
- %APPDATA%\oracle\bin\msvcr71.dll
- %APPDATA%\oracle\bin\pack200.exe
- %APPDATA%\oracle\bin\regutils.dll
- %APPDATA%\oracle\bin\rmi.dll
- %APPDATA%\oracle\bin\rmid.exe
- %APPDATA%\oracle\bin\rmiregistry.exe
- %APPDATA%\oracle\bin\servertool.exe
- %APPDATA%\oracle\bin\orbd.exe
- %APPDATA%\oracle\bin\fontmanager.dll
- %APPDATA%\oracle\bin\policytool.exe
- %APPDATA%\oracle\bin\mlib_image.dll
- %APPDATA%\oracle\bin\ktab.exe
- %APPDATA%\oracle\bin\klist.exe
- %APPDATA%\oracle\bin\jp2iexp.dll
- %APPDATA%\oracle\bin\jp2launcher.exe
- %APPDATA%\oracle\bin\jp2native.dll
- %APPDATA%\oracle\bin\jp2ssv.dll
- %APPDATA%\oracle\bin\jpeg.dll
- %APPDATA%\oracle\bin\jpicom.dll
- %APPDATA%\oracle\bin\jkernel.dll
- %APPDATA%\oracle\bin\jpiexp.dll
- %APPDATA%\oracle\bin\jpioji.dll
- %APPDATA%\oracle\bin\jpishare.dll
- %APPDATA%\oracle\bin\jqs.exe
- %APPDATA%\oracle\bin\jqsnotify.exe
- %APPDATA%\oracle\bin\jsound.dll
- %APPDATA%\oracle\bin\jsoundds.dll
- %APPDATA%\oracle\bin\keytool.exe
- %APPDATA%\oracle\bin\jpinscp.dll
- %APPDATA%\oracle\bin\kinit.exe
- %APPDATA%\oracle\bin\jdwp.dll
- %APPDATA%\oracle\lib\zi\pacific\niue
- %APPDATA%\oracle\lib\fonts\lucidasansregular.ttf
- %APPDATA%\oracle\lib\im\indicim.jar
- %APPDATA%\oracle\lib\zi\america\cambridge_bay
- %APPDATA%\oracle\lib\zi\america\campo_grande
- %APPDATA%\oracle\lib\zi\america\cancun
- %APPDATA%\oracle\lib\zi\america\caracas
- %APPDATA%\oracle\lib\zi\america\cayenne
- %APPDATA%\oracle\lib\zi\america\boa_vista
- %APPDATA%\oracle\lib\zi\america\cayman
- %APPDATA%\oracle\lib\zi\america\boise
- %APPDATA%\oracle\lib\zi\america\chihuahua
- %APPDATA%\oracle\lib\zi\america\creston
- %APPDATA%\oracle\lib\zi\america\cuiaba
- %APPDATA%\oracle\lib\zi\america\curacao
- %APPDATA%\oracle\lib\zi\america\danmarkshavn
- %APPDATA%\oracle\lib\zi\america\dawson
- %APPDATA%\oracle\lib\zi\america\chicago
- %APPDATA%\oracle\lib\zi\america\dawson_creek
- %APPDATA%\oracle\lib\zi\america\costa_rica
- %APPDATA%\oracle\lib\zi\america\bogota
- %APPDATA%\oracle\lib\zi\america\blanc-sablon
- %APPDATA%\oracle\lib\zi\america\belize
- %APPDATA%\oracle\lib\zi\africa\sao_tome
- %APPDATA%\oracle\lib\zi\africa\tripoli
- %APPDATA%\oracle\lib\zi\africa\tunis
- %APPDATA%\oracle\lib\zi\africa\windhoek
- %APPDATA%\oracle\lib\zi\america\adak
- %APPDATA%\oracle\lib\zi\america\anchorage
- %APPDATA%\oracle\lib\zi\africa\ouagadougou
- %APPDATA%\oracle\lib\zi\america\anguilla
- %APPDATA%\oracle\lib\zi\america\araguaina
- %APPDATA%\oracle\lib\zi\america\aruba
- %APPDATA%\oracle\lib\zi\america\asuncion
- %APPDATA%\oracle\lib\zi\america\atikokan
- %APPDATA%\oracle\lib\zi\america\bahia
- %APPDATA%\oracle\lib\zi\america\bahia_banderas
- %APPDATA%\oracle\lib\zi\america\barbados
- %APPDATA%\oracle\lib\zi\america\antigua
- %APPDATA%\oracle\lib\zi\america\belem
- %APPDATA%\oracle\lib\fonts\lucidatypewriterbold.ttf
- %APPDATA%\oracle\lib\zi\africa\porto-novo
- %APPDATA%\oracle\lib\zi\africa\nouakchott
- %APPDATA%\oracle\lib\zi\america\eirunepe
- %APPDATA%\oracle\lib\zi\america\maceio
- %APPDATA%\oracle\lib\zi\america\managua
- %APPDATA%\oracle\lib\zi\america\manaus
- %APPDATA%\oracle\lib\zi\america\martinique
- %APPDATA%\oracle\lib\zi\america\matamoros
- %APPDATA%\oracle\lib\zi\america\la_paz
- %APPDATA%\oracle\lib\zi\america\mazatlan
- %APPDATA%\oracle\lib\zi\america\los_angeles
- %APPDATA%\oracle\lib\zi\america\merida
- %APPDATA%\oracle\lib\zi\america\mexico_city
- %APPDATA%\oracle\lib\zi\america\miquelon
- %APPDATA%\oracle\lib\zi\america\moncton
- %APPDATA%\oracle\lib\zi\america\monterrey
- %APPDATA%\oracle\lib\zi\america\montevideo
- %APPDATA%\oracle\lib\zi\america\menominee
- %APPDATA%\oracle\lib\zi\america\denver
- %APPDATA%\oracle\lib\zi\america\metlakatla
- %APPDATA%\oracle\lib\zi\america\lima
- %APPDATA%\oracle\lib\zi\america\juneau
- %APPDATA%\oracle\lib\zi\america\jamaica
- %APPDATA%\oracle\lib\zi\america\el_salvador
- %APPDATA%\oracle\lib\zi\america\fortaleza
- %APPDATA%\oracle\lib\zi\america\glace_bay
- %APPDATA%\oracle\lib\zi\america\godthab
- %APPDATA%\oracle\lib\zi\america\goose_bay
- %APPDATA%\oracle\lib\zi\america\grand_turk
- %APPDATA%\oracle\lib\zi\america\edmonton
- %APPDATA%\oracle\lib\zi\america\grenada
- %APPDATA%\oracle\lib\zi\america\guatemala
- %APPDATA%\oracle\lib\zi\america\guayaquil
- %APPDATA%\oracle\lib\zi\america\guyana
- %APPDATA%\oracle\lib\zi\america\halifax
- %APPDATA%\oracle\lib\zi\america\havana
- %APPDATA%\oracle\lib\zi\america\hermosillo
- %APPDATA%\oracle\lib\zi\america\inuvik
- %APPDATA%\oracle\lib\zi\america\guadeloupe
- %APPDATA%\oracle\lib\zi\america\iqaluit
- %APPDATA%\oracle\lib\zi\america\dominica
- %APPDATA%\oracle\lib\fonts\lucidatypewriterregular.ttf
- %APPDATA%\oracle\lib\zi\america\detroit
- %APPDATA%\oracle\lib\fontconfig.98.bfc
- %APPDATA%\oracle\lib\zi\cet
- %APPDATA%\oracle\lib\zi\cst6cdt
- %APPDATA%\oracle\lib\zi\eet
- %APPDATA%\oracle\lib\zi\est
- %APPDATA%\oracle\lib\zi\est5edt
- %APPDATA%\oracle\lib\security\local_policy.jar
- %APPDATA%\oracle\lib\zi\gmt
- %APPDATA%\oracle\lib\servicetag\jdk_header.png
- %APPDATA%\oracle\lib\zi\met
- %APPDATA%\oracle\lib\zi\mst7mdt
- %APPDATA%\oracle\lib\zi\pst8pdt
- %APPDATA%\oracle\lib\zi\wet
- %APPDATA%\oracle\lib\zi\zoneinfomappings
- %APPDATA%\oracle\lib\zi\africa\abidjan
- %APPDATA%\oracle\lib\zi\hst
- %APPDATA%\oracle\lib\zi\africa\accra
- %APPDATA%\oracle\lib\zi\mst
- %APPDATA%\oracle\lib\security\us_export_policy.jar
- %APPDATA%\oracle\lib\security\javaws.policy
- %APPDATA%\oracle\lib\security\java.security
- %APPDATA%\oracle\lib\im\thaiim.jar
- %APPDATA%\oracle\lib\images\cursors\cursors.properties
- %APPDATA%\oracle\lib\images\cursors\invalid32x32.gif
- %APPDATA%\oracle\lib\images\cursors\win32_copydrop32x32.gif
- %APPDATA%\oracle\lib\images\cursors\win32_copynodrop32x32.gif
- %APPDATA%\oracle\lib\images\cursors\win32_linkdrop32x32.gif
- %APPDATA%\oracle\lib\i386\jvm.cfg
- %APPDATA%\oracle\lib\images\cursors\win32_linknodrop32x32.gif
- %APPDATA%\oracle\lib\images\cursors\win32_movenodrop32x32.gif
- %APPDATA%\oracle\lib\management\jmxremote.access
- %APPDATA%\oracle\lib\management\jmxremote.password.template
- %APPDATA%\oracle\lib\management\management.properties
- %APPDATA%\oracle\lib\management\snmp.acl.template
- %APPDATA%\oracle\lib\security\blacklist
- %APPDATA%\oracle\lib\security\cacerts
- %APPDATA%\oracle\lib\images\cursors\win32_movedrop32x32.gif
- %APPDATA%\oracle\lib\security\java.policy
- %APPDATA%\oracle\lib\zi\africa\nairobi
- %APPDATA%\oracle\lib\zi\africa\niamey
- %APPDATA%\oracle\lib\zi\africa\ndjamena
- %APPDATA%\oracle\lib\zi\africa\bangui
- %APPDATA%\oracle\lib\zi\africa\kigali
- %APPDATA%\oracle\lib\zi\africa\kinshasa
- %APPDATA%\oracle\lib\zi\africa\lagos
- %APPDATA%\oracle\lib\zi\africa\libreville
- %APPDATA%\oracle\lib\zi\africa\lome
- %APPDATA%\oracle\lib\zi\africa\juba
- %APPDATA%\oracle\lib\zi\africa\luanda
- %APPDATA%\oracle\lib\zi\africa\khartoum
- %APPDATA%\oracle\lib\zi\africa\lusaka
- %APPDATA%\oracle\lib\zi\africa\maputo
- %APPDATA%\oracle\lib\zi\africa\maseru
- %APPDATA%\oracle\lib\zi\africa\mbabane
- %APPDATA%\oracle\lib\zi\africa\mogadishu
- %APPDATA%\oracle\lib\zi\africa\monrovia
- %APPDATA%\oracle\lib\zi\africa\lubumbashi
- %APPDATA%\oracle\lib\zi\africa\addis_ababa
- %APPDATA%\oracle\lib\zi\africa\malabo
- %APPDATA%\oracle\lib\zi\africa\kampala
- %APPDATA%\oracle\lib\zi\africa\johannesburg
- %APPDATA%\oracle\lib\zi\africa\harare
- %APPDATA%\oracle\lib\zi\africa\banjul
- %APPDATA%\oracle\lib\zi\africa\bissau
- %APPDATA%\oracle\lib\zi\africa\blantyre
- %APPDATA%\oracle\lib\zi\africa\brazzaville
- %APPDATA%\oracle\lib\zi\africa\bujumbura
- %APPDATA%\oracle\lib\zi\africa\cairo
- %APPDATA%\oracle\lib\zi\africa\bamako
- %APPDATA%\oracle\lib\zi\africa\casablanca
- %APPDATA%\oracle\lib\zi\africa\conakry
- %APPDATA%\oracle\lib\zi\africa\dakar
- %APPDATA%\oracle\lib\zi\africa\dar_es_salaam
- %APPDATA%\oracle\lib\zi\africa\djibouti
- %APPDATA%\oracle\lib\zi\africa\douala
- %APPDATA%\oracle\lib\zi\africa\el_aaiun
- %APPDATA%\oracle\lib\zi\africa\freetown
- %APPDATA%\oracle\lib\zi\africa\ceuta
- %APPDATA%\oracle\lib\zi\africa\gaborone
- %APPDATA%\oracle\lib\zi\africa\asmara
- %TEMP%\uprjdabcdu8642129331387972886.reg
- <Drive name for removable media>:\ttwfhnooez.js
- %HOMEPATH%\rxwdqrvtodj\id.txt
- %HOMEPATH%\rxwdqrvtodj\iylxoxtcvmx.xjvsrr
- %TEMP%\retrive7354408981700992121.vbs
- %TEMP%\retrive3792692243016155524.vbs
- %TEMP%\retrive5580411698521728140.vbs
- %TEMP%\retrive3314857813702778942.vbs
- %TEMP%\retrive8867415420781598799.vbs
- %TEMP%\retrive9185351570996083359.vbs
- %TEMP%\retrive6181063479674248693.vbs
- %TEMP%\retrive2104408020047118759.vbs
- 'localhost':7777
- DNS ASK pl#####rv1.duckdns.org
- DNS ASK vi####7.duckdns.org
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- '<SYSTEM32>\wscript.exe' "%APPDATA%\ttWFhNOoez.js"
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive3792692243016155524.vbs
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive7354408981700992121.vbs
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive3314857813702778942.vbs
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive5580411698521728140.vbs
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive9185351570996083359.vbs
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive8867415420781598799.vbs
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive2104408020047118759.vbs
- '<SYSTEM32>\cscript.exe' %TEMP%\Retrive6181063479674248693.vbs
- '%ProgramFiles%\java\jre6\bin\javaw.exe' -jar "%APPDATA%\jupsiy.txt"
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive2104408020047118759.vbs
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive6181063479674248693.vbs
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive9185351570996083359.vbs
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive8867415420781598799.vbs
- '<SYSTEM32>\attrib.exe' +h "%HOMEPATH%\rXwDqRVtodJ"
- '<SYSTEM32>\attrib.exe' +h "%HOMEPATH%\rXwDqRVtodJ\*.*"
- '<SYSTEM32>\cmd.exe' /c regedit.exe /s %TEMP%\uPRjDaBcdu8642129331387972886.reg
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v dWKZgMOPjOs /t REG_EXPAND_SZ /d "\"%APPDATA%\Oracle\bin\javaw.exe\" -jar \"%HOMEPATH%\rXwDqRVtodJ\iylXOXTCvmX.xJvsrR\"" /f
- '<SYSTEM32>\xcopy.exe' "%ProgramFiles%\Java\jre6" "%APPDATA%\Oracle\" /e
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive3314857813702778942.vbs
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive5580411698521728140.vbs
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive7354408981700992121.vbs
- '<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive3792692243016155524.vbs
- '%ProgramFiles%\java\jre6\bin\java.exe' -jar %TEMP%\_0.186665152814548984826134752243501667.class
- '<SYSTEM32>\cmd.exe'
- '%WINDIR%\regedit.exe' /s %TEMP%\uPRjDaBcdu8642129331387972886.reg