Technical Information
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}
- %WINDIR%\syswow64\explorer.exe
- %WINDIR%\explorer.exe
- iexplore.exe
- firefox.exe process, nss3.dll module
- iexplore.exe process, wininet.dll module
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Wow6432Node\Martin Prikryl]
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\thunderbird\profiles.ini
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %TEMP%\4dd3.tmp
- %TEMP%\tmp33ae.tmp
- %TEMP%\tmp33af.tmp
- %TEMP%\tmp33b0.tmp
- %TEMP%\tmp33c0.tmp
- %TEMP%\tmp33c1.tmp
- %TEMP%\tmp33ac.tmp
- %TEMP%\tmp33ad.tmp
- %TEMP%\tmp33c2.tmp
- %TEMP%\tmp33c5.tmp
- %TEMP%\tmp33d6.tmp
- %TEMP%\tmp33d7.tmp
- %TEMP%\tmp33e8.tmp
- %TEMP%\tmp33e9.tmp
- %TEMP%\tmp33c3.tmp
- %TEMP%\tmp33c4.tmp
- %TEMP%\tmp33eb.tmp
- %TEMP%\tmp33ea.tmp
- %TEMP%\tmp3399.tmp
- %TEMP%\tmp336e.tmp
- %TEMP%\tmp336f.tmp
- %TEMP%\tmp3370.tmp
- %TEMP%\tmp3371.tmp
- %TEMP%\tmp339a.tmp
- %TEMP%\tmp335c.tmp
- %TEMP%\tmp339b.tmp
- %TEMP%\tmp3372.tmp
- %TEMP%\tmp3386.tmp
- %TEMP%\tmp3387.tmp
- %TEMP%\tmp3397.tmp
- %TEMP%\tmp3398.tmp
- %TEMP%\tmp3383.tmp
- %TEMP%\tmp3384.tmp
- %TEMP%\tmp3385.tmp
- %TEMP%\ccb7.tmp
- %TEMP%\tmp33fb.tmp
- %TEMP%\tmp344f.tmp
- %TEMP%\tmp3451.tmp
- %TEMP%\tmp3452.tmp
- %TEMP%\tmp3453.tmp
- %TEMP%\tmp3463.tmp
- %TEMP%\tmp343e.tmp
- %TEMP%\tmp3464.tmp
- %TEMP%\tmp3450.tmp
- %TEMP%\tmp3476.tmp
- %TEMP%\tmp3478.tmp
- %TEMP%\tmp3479.tmp
- %TEMP%\tmp347a.tmp
- %TEMP%\tmp348a.tmp
- %TEMP%\tmp3465.tmp
- %TEMP%\tmp343d.tmp
- %TEMP%\tmp3477.tmp
- %TEMP%\tmp343c.tmp
- %TEMP%\tmp343b.tmp
- %TEMP%\tmp33fd.tmp
- %TEMP%\tmp340f.tmp
- %TEMP%\tmp3410.tmp
- %TEMP%\tmp3411.tmp
- %TEMP%\tmp3412.tmp
- %TEMP%\tmp3413.tmp
- %TEMP%\tmp3423.tmp
- %TEMP%\tmp33fe.tmp
- %TEMP%\tmp3424.tmp
- %TEMP%\tmp3426.tmp
- %TEMP%\tmp3427.tmp
- %TEMP%\tmp3428.tmp
- %TEMP%\tmp3439.tmp
- %TEMP%\tmp343a.tmp
- %TEMP%\tmp335b.tmp
- %TEMP%\tmp3425.tmp
- %TEMP%\tmp335d.tmp
- %TEMP%\tmp335a.tmp
- %TEMP%\tmp334a.tmp
- %TEMP%\tmp3349.tmp
- %TEMP%\af72.tmp.exe
- %TEMP%\b933.tmp.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\images\48x48.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\images\128x128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\bg.js
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %TEMP%\c9f3.tmp
- %TEMP%\cb7a.tmp
- %TEMP%\cbaa.tmp
- %TEMP%\cc38.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\c9d3.tmp
- %TEMP%\c9d3.tmp-shm
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\images\48x48-gray.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\_locales\ru\messages.json
- %TEMP%\cc39.tmp
- %APPDATA%\jaicdtr
- %TEMP%\9bf0.tmp.exe
- %TEMP%\a499.tmp.exe
- %LOCALAPPDATA%\5g1aeaoioc0dywlabet7hciy8gaslocu
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\manifest.json
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\_locales\en\messages.json
- %APPDATA%\frciucs
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\_locales\ru\messages.json
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\images\48x48-gray.png
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\images\48x48.png
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\images\toolbaricon\48x48.png
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\bg.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\_locales\en\messages.json
- %APPDATA%\opera software\opera stable\extensions\ldpjcmkglojmknbfljmdcgmgkcbbopgb\10.1.1.2_0\images\128x128.png
- %TEMP%\tmp349b.tmp
- %TEMP%\tmp33fc.tmp
- %TEMP%\ccb6.tmp
- %TEMP%\ccda.tmp
- %TEMP%\tmp330e.tmp
- %TEMP%\tmp330f.tmp
- %TEMP%\tmp3310.tmp
- %TEMP%\tmp3321.tmp
- %TEMP%\tmp32fb.tmp
- %TEMP%\tmp3322.tmp
- %TEMP%\tmp330d.tmp
- %TEMP%\tmp3324.tmp
- %TEMP%\tmp3335.tmp
- %TEMP%\tmp3336.tmp
- %TEMP%\tmp3337.tmp
- %TEMP%\tmp3338.tmp
- %TEMP%\tmp3323.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dhmmohpmndclagmbldnmfnplecjfghem\10.1.1.2_0\images\toolbaricon\48x48.png
- %TEMP%\tmp3325.tmp
- %TEMP%\tmp32fc.tmp
- %TEMP%\tmp32fa.tmp
- %TEMP%\tmp32f9.tmp
- %TEMP%\ccea.tmp
- %TEMP%\cceb.tmp
- %TEMP%\ccfc.tmp
- %TEMP%\cd0c.tmp
- %TEMP%\cd0c.tmp-shm
- %TEMP%\ccc9.tmp
- %ALLUSERSPROFILE%\q6y0s9p7y2y0s9p7y2\ln
- %TEMP%\tmp3295.tmp
- %TEMP%\tmp32d4.tmp
- %TEMP%\tmp32d5.tmp
- %TEMP%\tmp32d6.tmp
- %TEMP%\tmp32e7.tmp
- %TEMP%\tmp32e8.tmp
- %TEMP%\tmp3294.tmp
- %TEMP%\tmp32e9.tmp
- %TEMP%\ccc8.tmp
- %TEMP%\tmp34ac.tmp
- %APPDATA%\frciucs
- %APPDATA%\jaicdtr
- %LOCALAPPDATA%\5g1aeaoioc0dywlabet7hciy8gaslocu
- %TEMP%\tmp33fb.tmp
- %TEMP%\tmp33ea.tmp
- %TEMP%\tmp33e8.tmp
- %TEMP%\tmp33d6.tmp
- %TEMP%\tmp33c4.tmp
- %TEMP%\tmp33c2.tmp
- %TEMP%\tmp33fd.tmp
- %TEMP%\tmp33c0.tmp
- %TEMP%\tmp33ad.tmp
- %TEMP%\tmp339b.tmp
- %TEMP%\tmp3399.tmp
- %TEMP%\tmp3397.tmp
- %TEMP%\tmp3386.tmp
- %TEMP%\tmp3384.tmp
- %TEMP%\tmp33af.tmp
- %TEMP%\tmp3450.tmp
- %TEMP%\tmp349b.tmp
- %TEMP%\tmp3413.tmp
- %TEMP%\tmp348a.tmp
- %TEMP%\tmp347a.tmp
- %TEMP%\tmp3479.tmp
- %TEMP%\tmp3477.tmp
- %TEMP%\tmp3465.tmp
- %TEMP%\tmp3463.tmp
- %TEMP%\tmp3372.tmp
- %TEMP%\tmp3452.tmp
- %TEMP%\tmp343e.tmp
- %TEMP%\tmp343c.tmp
- %TEMP%\tmp343a.tmp
- %TEMP%\tmp3428.tmp
- %TEMP%\tmp3426.tmp
- %TEMP%\tmp3424.tmp
- %TEMP%\tmp340f.tmp
- %TEMP%\tmp3411.tmp
- %TEMP%\tmp3370.tmp
- %TEMP%\cd0c.tmp
- %TEMP%\cceb.tmp
- %TEMP%\ccea.tmp
- %TEMP%\ccda.tmp
- %TEMP%\ccc9.tmp
- %TEMP%\ccc8.tmp
- %TEMP%\ccb7.tmp
- %TEMP%\ccfc.tmp
- %TEMP%\ccb6.tmp
- %TEMP%\cc38.tmp
- %TEMP%\cbaa.tmp
- %TEMP%\cb7a.tmp
- %TEMP%\c9f3.tmp
- %TEMP%\c9d3.tmp
- %TEMP%\c9d3.tmp-shm
- %TEMP%\cc39.tmp
- %TEMP%\tmp330e.tmp
- %TEMP%\tmp335c.tmp
- %ALLUSERSPROFILE%\q6y0s9p7y2y0s9p7y2\ln
- %TEMP%\tmp335a.tmp
- %TEMP%\tmp3349.tmp
- %TEMP%\tmp3337.tmp
- %TEMP%\tmp3335.tmp
- %TEMP%\tmp3324.tmp
- %TEMP%\tmp3322.tmp
- %TEMP%\tmp336e.tmp
- %TEMP%\tmp3310.tmp
- %TEMP%\tmp32fc.tmp
- %TEMP%\tmp32fa.tmp
- %TEMP%\tmp32e9.tmp
- %TEMP%\tmp32e7.tmp
- %TEMP%\tmp32d5.tmp
- %TEMP%\tmp3295.tmp
- %TEMP%\cd0c.tmp-shm
- %TEMP%\tmp34ac.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\secure preferences
- %ALLUSERSPROFILE%\q6y0s9p7y2y0s9p7y2\ln
- '10##########older1002-0155251002202035.site':80
- '18#.#12.131.241':80
- '80.##.245.80':80
- '10#.#34.38.124':35200
- 'yo####soslow.top':443
- 'ap#.ip.sb':443
- http://10##########older1002-0155251002202035.site/raccon.exe
- http://10###########lder1002002131-service1002.space/
- http://10##########older33417-01242510022020.space/
- http://10############6831-service1002012510022020.space/
- http://10##########older1002-0155251002202035.site/
- http://80.##.245.80/log/
- http://10#.###.38.124:35200/ via 10#.#34.38.124
- DNS ASK 10###########lder1002002131-service1002.space
- DNS ASK 10##########older1002-0134251002202035.site
- DNS ASK 10##########older1002-0133251002202035.site
- DNS ASK 10##########older1002-0132251002202035.site
- DNS ASK 10##########older1002-0131251002202035.site
- DNS ASK 10##########older1002-0130251002202035.site
- DNS ASK 10##########older1002-01292510022020.com
- DNS ASK 10#########folder1002-01282510022020.gq
- DNS ASK 10#########folder1002-01272510022020.cf
- DNS ASK 10#########folder1002-01262510022020.ga
- DNS ASK 10#########folder1002-01252510022020.ml
- DNS ASK 10##########older100221-service1022020.ru
- DNS ASK 10##########older100231-service1022020.ru
- DNS ASK 10###########lder100241-service1002010022020.ru
- DNS ASK 10###########lder100251-service2510022020.ru
- DNS ASK 10############dert161-service100201242510022020.ru
- DNS ASK 10###########t151-service100201242510022020.ru
- DNS ASK 10###########est561-service1002012510022020.ru
- DNS ASK 10###########est981-service1002012510022020.ru
- DNS ASK 10###########est451-service1002012510022020.ru
- DNS ASK 10###########est971-service1002012510022020.ru
- DNS ASK 10###########est871-service1002012510022020.ru
- DNS ASK 10##########older1002-0135251002202035.site
- DNS ASK 10##########older1002-0136251002202035.site
- DNS ASK te##te.in
- DNS ASK 10##########older1002-0155251002202035.site
- DNS ASK 10##########older1002-0154251002202035.site
- DNS ASK 10##########older1002-0153251002202035.site
- DNS ASK 10##########older1002-0152251002202035.site
- DNS ASK 10##########older1002-0151251002202035.site
- DNS ASK 10##########older1002-0150251002202035.site
- DNS ASK 10##########older1002-0149251002202035.site
- DNS ASK 10##########older1002-0148251002202035.site
- DNS ASK 10##########older1002-0146251002202035.site
- DNS ASK 10##########571-service1002012510022020.pro
- DNS ASK 10##########older1002-0145251002202035.site
- DNS ASK 10##########older1002-0144251002202035.site
- DNS ASK 10##########older1002-0143251002202035.site
- DNS ASK 10##########older1002-0142251002202035.site
- DNS ASK 10##########older1002-0141251002202035.site
- DNS ASK 10##########older1002-0140251002202035.site
- DNS ASK 10##########older1002-0139251002202035.site
- DNS ASK 10##########older1002-0138251002202035.site
- DNS ASK 10##########older1002-0137251002202035.site
- DNS ASK 10###########est341-service1002012510022020.ru
- DNS ASK 10###########est251-service1002012510022020.ru
- DNS ASK 10#############er1002-service100201blog2510022020.ru
- DNS ASK 10###########1-service100201dom2510022020.ru
- DNS ASK 10###########1341-service1002012510022020.ru
- DNS ASK 10############671-service1002012510022020.online
- DNS ASK 10###########5671-service1002012510022020.tech
- DNS ASK 10###########3461-service1002012510022020.net
- DNS ASK 10###########4781-service1002012510022020.info
- DNS ASK 10###########3561-service1002012510022020.su
- DNS ASK 10###########3481-service1002012510022020.ru
- DNS ASK 10###########3531-service100201242510022020.ru
- DNS ASK 10############4831-service1002012510022020.space
- DNS ASK 10############7831-service1002012510022020.space
- DNS ASK 10############6831-service1002012510022020.space
- DNS ASK 10############5831-service1002012510022020.space
- DNS ASK 10##########older33417-01242510022020.space
- DNS ASK 10###########lder1002002531-service1002.space
- DNS ASK 10###########lder1002002431-service1002.space
- DNS ASK 10##########older3100231-service1002.space
- DNS ASK 10###########lder1002002231-service1002.space
- DNS ASK 10##########51-service1002012510022020.xyz
- DNS ASK 10###########1-service100201pro2510022020.ru
- DNS ASK 10###########1-service1002012510022020.website
- DNS ASK 10###########1-service100201rus2510022020.ru
- DNS ASK 10#############er1002-service100201life2510022020.ru
- DNS ASK 10##########21-service1002012510022020.eu
- DNS ASK 10#############er1002-service100201shop2510022020.ru
- DNS ASK 10###########lder241-service1002012510022020.ru
- DNS ASK 10###########lder351-service1002012510022020.ru
- DNS ASK 10###########lder471-service1002012510022020.ru
- DNS ASK 10###########lder481-service1002012510022020.ru
- DNS ASK 10###########st361-service1002012510022020.ru
- DNS ASK 10###########st371-service1002012510022020.ru
- DNS ASK 10##########231-service1002012510022020.fun
- DNS ASK 10##########older1002-0147251002202035.site
- DNS ASK yo####soslow.top
- DNS ASK 10##########481-service1002012510022020.ru
- DNS ASK 10##########391-service1002012510022020.ru
- DNS ASK 10###########st231-service1002012510022020.ru
- DNS ASK 10###########st251-service1002012510022020.ru
- DNS ASK 10###########61-service1002012510022020.space
- DNS ASK 10##########281-service1002012510022020.ru
- DNS ASK 10###########st213-service1002012510022020.ru
- DNS ASK 10############der4561-service1002012510022020.ru
- DNS ASK 10###########1-service1002012510022020.press
- DNS ASK 10###########61-service1002012510022020.host
- DNS ASK ap#.ip.sb
- '%TEMP%\9bf0.tmp.exe'
- '%TEMP%\a499.tmp.exe'
- '%TEMP%\af72.tmp.exe'
- '%TEMP%\b933.tmp.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'