Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Host Process for Windows Services' = '%WINDIR%\281793033317869\svchost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Host Process for Windows Services' = '%WINDIR%\281793033317869\svchost.exe'
- <Drive name for removable media>:\__\drivemgr.exe
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\asaprojectcompetition.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\sim_gametheory_to_finance.ppt
- <Drive name for removable media>:\mappingconcepthubberlin.ppt
- <Drive name for removable media>:\proposaltemplates.ppt
- <Drive name for removable media>:\arrow-down.png
- <Drive name for removable media>:\background.png
- <Drive name for removable media>:\asm.png
- <Drive name for removable media>:\dissolveanother.png
- <Drive name for removable media>:\breakpoint.png
- <Drive name for removable media>:\cbz.png
- <Drive name for removable media>:\systisoft.pem
- <Drive name for removable media>:\tunpersonalca1.pem
- <Drive name for removable media>:\cert.pem
- <Drive name for removable media>:\hhhlcert.pem
- <Drive name for removable media>:\delongcacert.pem
- <Drive name for removable media>:\server.pem
- <Drive name for removable media>:\ck.pem
- <Drive name for removable media>:\bc01.pdf
- <Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
- <Drive name for removable media>:\fil_20060629111052.pdf
- <Drive name for removable media>:\video_1.mp4
- <Drive name for removable media>:\video.mp4
- <Drive name for removable media>:\etc6_m_1.mov
- <Drive name for removable media>:\spanner.mov
- <Drive name for removable media>:\sioc.rdf
- <Drive name for removable media>:\contenttypes.rdf
- <Drive name for removable media>:\calculatorworksheet.zip
- <Drive name for removable media>:\fiche_inscription_2015.zip
- <Drive name for removable media>:\2013_finalsummaryforweb.xlsx
- <Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
- <Drive name for removable media>:\suspendedcompanies.xlsx
- <Drive name for removable media>:\al.xlsx
- <Drive name for removable media>:\applicant.xlsx
- <Drive name for removable media>:\disclosuredetails.xlsx
- <Drive name for removable media>:\guide_reorganization_mapping.xls
- <Drive name for removable media>:\1sm_price.xls
- <Drive name for removable media>:\fiche_inscription_2015.xls
- <Drive name for removable media>:\contractualdeadlines.xls
- <Drive name for removable media>:\subjectclassification.xls
- <Drive name for removable media>:\alert.html
- <Drive name for removable media>:\babyboymaintoscenesbackground.wmv
- <Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
- <Drive name for removable media>:\flower_trans_matte.wmv
- <Drive name for removable media>:\waterlandhealthkano.rtf
- <Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
- <Drive name for removable media>:\phytoremediation.rtf
- <Drive name for removable media>:\pandp.rtf
- <Drive name for removable media>:\military_callsigns_0311.rtf
- <Drive name for removable media>:\elvisimp.rdf
- <Drive name for removable media>:\schema.rdf
- <Drive name for removable media>:\20140114.rdf
- <Drive name for removable media>:\foaf.rdf
- <Drive name for removable media>:\dag2_panel1_320_ref.mov
- <Drive name for removable media>:\1189.jpg
- <Drive name for removable media>:\4f0bf7ff71f28.jpg
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\.lnk
- <Drive name for removable media>:\glidescope_review_rev_010.docx
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
- <Drive name for removable media>:\region-north-karelia.jpg
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\168.jpg
- <Drive name for removable media>:\pushkin.jpg
- <Drive name for removable media>:\parnas_01.jpg
- <Drive name for removable media>:\3.jpg
- <Drive name for removable media>:\pushkin.jpeg
- <Drive name for removable media>:\210252809.jpeg
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\1189.jpeg
- <Drive name for removable media>:\ituneshelpunavailable.html
- <Drive name for removable media>:\about.html
- <Drive name for removable media>:\adadsi.html
- <Drive name for removable media>:\calculatorworksheet.xls
- <Drive name for removable media>:\contractualdeadlines.zip
- <Drive name for removable media>:\64bit_notes.htm
- <Drive name for removable media>:\alert.htm
- <Drive name for removable media>:\garden.htm
- <Drive name for removable media>:\browse.htm
- <Drive name for removable media>:\ituneshelpunavailable.htm
- <Drive name for removable media>:\calc.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\tcm851ax32.exe
- <Drive name for removable media>:\file_p_00000000_1371597592.docx
- <Drive name for removable media>:\adhd_and_obesity.docx
- <Drive name for removable media>:\howto-index.html
- <Drive name for removable media>:\price.zip
- Windows Security Center
- %WINDIR%\281793033317869\svchost.exe
- %WINDIR%\281793033317869\svchost.exe
- <Drive name for removable media>:\.lnk
- http://tl##net.top/1
- http://ta####babefnefmf.ws/3
- http://ta####babefnefmf.ws/2
- http://ta####babefnefmf.ws/1
- http://te####zdgzegdget.ws/8
- http://te####zdgzegdget.ws/7
- http://te####zdgzegdget.ws/6
- http://te####zdgzegdget.ws/5
- http://te####zdgzegdget.ws/4
- http://te####zdgzegdget.ws/3
- http://te####zdgzegdget.ws/2
- http://te####zdgzegdget.ws/1
- http://ta####babefnefmf.ws/5
- http://ta####babefnefmf.ws/4
- http://ta####abdmemdnaf.ws/6
- http://ta####abdmemdnaf.ws/5
- http://ta####abdmemdnaf.ws/4
- http://ta####abdmemdnaf.ws/3
- http://ta####abdmemdnaf.ws/2
- http://ta####abdmemdnaf.ws/1
- http://tp####pokadkeoot.ws/8
- http://tp####pokadkeoot.ws/7
- http://tp####pokadkeoot.ws/6
- http://tp####pokadkeoot.ws/5
- http://tp####pokadkeoot.ws/4
- http://ta####abdmemdnaf.ws/8
- http://to####iorgididii.ws/5
- http://ta####babefnefmf.ws/6
- http://tg####udbbchaiii.ws/8
- http://tg####udbbchaiii.ws/7
- http://tg####udbbchaiii.ws/6
- http://tg####udbbchaiii.ws/5
- http://tg####udbbchaiii.ws/4
- http://tg####udbbchaiii.ws/3
- http://tg####udbbchaiii.ws/2
- http://tg####udbbchaiii.ws/1
- http://te####ufuanbbgbg.ws/8
- http://te####ufuanbbgbg.ws/7
- http://te####ufuanbbgbg.ws/6
- http://te####ufuanbbgbg.ws/5
- http://te####ufuanbbgbg.ws/4
- http://te####ufuanbbgbg.ws/3
- http://te####ufuanbbgbg.ws/2
- http://te####ufuanbbgbg.ws/1
- http://ta####iednaibduf.ws/8
- http://ta####iednaibduf.ws/7
- http://ta####iednaibduf.ws/6
- http://ta####iednaibduf.ws/5
- http://ta####iednaibduf.ws/4
- http://ta####iednaibduf.ws/3
- http://ta####iednaibduf.ws/2
- http://ta####iednaibduf.ws/1
- http://ta####babefnefmf.ws/8
- http://tp####pokadkeoot.ws/3
- http://ta####abdmemdnaf.ws/7
- http://tp####pokadkeoot.ws/2
- http://tp####pokadkeoot.ws/1
- http://to####huoaefhefu.ws/8
- http://21#.#.117.63/6
- http://to####iorgididii.ws/1
- http://to####iofiehfihf.ws/8
- http://to####iofiehfihf.ws/7
- http://to####iofiehfihf.ws/6
- http://to####iofiehfihf.ws/5
- http://to####iofiehfihf.ws/4
- http://to####iofiehfihf.ws/3
- http://to####iofiehfihf.ws/2
- http://to####iofiehfihf.ws/1
- http://21#.#.117.63/8
- http://21#.#.117.63/7
- http://21#.#.117.63/5
- http://to####iorgididii.ws/3
- http://21#.#.117.63/4
- http://21#.#.117.63/3
- http://21#.#.117.63/2
- http://21#.#.117.63/1
- http://tl##net.top/8
- http://tl##net.top/7
- http://tl##net.top/6
- http://tl##net.top/5
- http://tl##net.top/4
- http://tl##net.top/3
- http://tl##net.top/2
- http://tp####ieifuebaub.ws/1
- http://ta####babefnefmf.ws/7
- http://to####iorgididii.ws/4
- http://to####iorgididii.ws/7
- http://to####iorgididii.ws/2
- http://to####huoaefhefu.ws/7
- http://to####huoaefhefu.ws/6
- http://to####huoaefhefu.ws/5
- http://to####huoaefhefu.ws/4
- http://to####huoaefhefu.ws/3
- http://to####huoaefhefu.ws/2
- http://to####huoaefhefu.ws/1
- http://ti####fbiaebfiie.ws/8
- http://ti####fbiaebfiie.ws/7
- http://ti####fbiaebfiie.ws/6
- http://ti####fbiaebfiie.ws/5
- http://ti####fbiaebfiie.ws/4
- http://ti####fbiaebfiie.ws/3
- http://ti####fbiaebfiie.ws/2
- http://ti####fbiaebfiie.ws/1
- http://te####ijiejdijef.ws/8
- http://te####ijiejdijef.ws/7
- http://te####ijiejdijef.ws/6
- http://te####ijiejdijef.ws/5
- http://te####ijiejdijef.ws/4
- http://te####ijiejdijef.ws/3
- http://te####ijiejdijef.ws/2
- http://te####ijiejdijef.ws/1
- http://to####iorgididii.ws/8
- http://to####iorgididii.ws/6
- http://tp####ieifuebaub.ws/2
- DNS ASK tl##net.top
- DNS ASK ll####imonadfueh.to
- DNS ASK la####zdeahfhuea.to
- DNS ASK lg####eidiehgihe.to
- DNS ASK to####iofiehfihf.ws
- DNS ASK to####iorgididii.ws
- DNS ASK te####ijiejdijef.ws
- DNS ASK to####huoaefhefu.ws
- DNS ASK le####zdgzegdget.to
- DNS ASK tp####pokadkeoot.ws
- DNS ASK ta####abdmemdnaf.ws
- DNS ASK te####zdgzegdget.ws
- DNS ASK ta####babefnefmf.ws
- DNS ASK ta####iednaibduf.ws
- DNS ASK te####ufuanbbgbg.ws
- DNS ASK ln####ffhshsueur.to
- DNS ASK lb####molaedbfau.to
- DNS ASK le####ieiififnnf.to
- DNS ASK lf####beanfienfi.to
- DNS ASK lp####ieifuebaub.to
- DNS ASK lg####udbbchaiii.to
- DNS ASK le####ufuanbbgbg.to
- DNS ASK la####iednaibduf.to
- DNS ASK la####babefnefmf.to
- DNS ASK ti####fbiaebfiie.ws
- DNS ASK la####abdmemdnaf.to
- DNS ASK lp####pokadkeoot.to
- DNS ASK lo####huoaefhefu.to
- DNS ASK li####fbiaebfiie.to
- DNS ASK le####ijiejdijef.to
- DNS ASK lo####iorgididii.to
- DNS ASK lo####iofiehfihf.to
- DNS ASK tg####udbbchaiii.ws
- DNS ASK tp####ieifuebaub.ws
- '%WINDIR%\281793033317869\svchost.exe'