Technical Information
- <SYSTEM32>\tasks\firefox default browser agent da59ebdc7270c466
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
- 3286.exe
- iexplore.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Wow6432Node\Martin Prikryl]
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %TEMP%\ae30.tmp
- %TEMP%\tmpe201.tmp
- %TEMP%\tmpe1f1.tmp
- %TEMP%\tmpe1e0.tmp
- %TEMP%\tmpe1df.tmp
- %TEMP%\tmpe1bf.tmp
- %TEMP%\tmpe1be.tmp
- %TEMP%\tmpe1bd.tmp
- %TEMP%\tmpe1bc.tmp
- %TEMP%\tmpe1ab.tmp
- %TEMP%\tmpe17b.tmp
- %TEMP%\tmpe13f.tmp
- %TEMP%\tmpe17a.tmp
- %TEMP%\tmpe169.tmp
- %TEMP%\tmpe168.tmp
- %TEMP%\tmpe167.tmp
- %TEMP%\tmpe166.tmp
- %TEMP%\tmpe155.tmp
- %TEMP%\tmpe154.tmp
- %TEMP%\tmpe153.tmp
- %TEMP%\tmpe152.tmp
- %TEMP%\tmpe142.tmp
- %TEMP%\tmpe141.tmp
- %TEMP%\tmpe179.tmp
- %TEMP%\tmpe140.tmp
- %TEMP%\tmpe212.tmp
- %TEMP%\tmpe873.tmp
- %TEMP%\tmpe8bc.tmp
- %TEMP%\tmpe8ab.tmp
- %TEMP%\tmpe8aa.tmp
- %TEMP%\tmpe8a9.tmp
- %TEMP%\tmpe899.tmp
- %TEMP%\tmpe898.tmp
- %TEMP%\tmpe897.tmp
- %TEMP%\tmpe896.tmp
- %TEMP%\tmpe885.tmp
- %TEMP%\tmpe884.tmp
- %TEMP%\tmpe233.tmp
- %TEMP%\tmpe222.tmp
- %TEMP%\tmpe852.tmp
- %TEMP%\tmpe851.tmp
- %TEMP%\tmpe850.tmp
- %TEMP%\tmpe84f.tmp
- %TEMP%\tmpe84e.tmp
- %TEMP%\tmpe84d.tmp
- %TEMP%\tmpe82d.tmp
- %TEMP%\tmpe82c.tmp
- %TEMP%\tmpe283.tmp
- %TEMP%\tmpe272.tmp
- %TEMP%\tmpe874.tmp
- %TEMP%\tmpe12e.tmp
- %TEMP%\tmpe12c.tmp
- %TEMP%\tmpe8ce.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\tmpe025.tmp
- %TEMP%\tmpe024.tmp
- %TEMP%\tmpe023.tmp
- %TEMP%\tmpe022.tmp
- %TEMP%\tmpe011.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\tmpe048.tmp
- %TEMP%\tmpe037.tmp
- %TEMP%\tmpe038.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\tmpe059.tmp
- %TEMP%\tmpe12b.tmp
- %TEMP%\tmpe8cd.tmp
- %TEMP%\tmpe026.tmp
- %TEMP%\tmpe11a.tmp
- %TEMP%\tmpe119.tmp
- %TEMP%\tmpe118.tmp
- %TEMP%\tmpe117.tmp
- %TEMP%\tmpe107.tmp
- %TEMP%\tmpe106.tmp
- %TEMP%\tmpe0f5.tmp
- %TEMP%\tmpe0f4.tmp
- %TEMP%\tmpe0e4.tmp
- %TEMP%\tmpe0e3.tmp
- %TEMP%\tmpe0e2.tmp
- %TEMP%\tmpe0e1.tmp
- %TEMP%\tmpe0a1.tmp
- %TEMP%\tmpe0a0.tmp
- %TEMP%\tmpe090.tmp
- %TEMP%\tmpe08f.tmp
- %TEMP%\tmpe07e.tmp
- %TEMP%\tmpe07d.tmp
- %TEMP%\tmpe06c.tmp
- %TEMP%\tmpe06b.tmp
- %TEMP%\tmpe06a.tmp
- %TEMP%\tmpe069.tmp
- %TEMP%\tmpe12d.tmp
- %TEMP%\tmpd250.tmp
- %TEMP%\tmpe8de.tmp
- %TEMP%\tmp4c7.tmp
- %TEMP%\tmp4b6.tmp
- %TEMP%\tmp4b5.tmp
- %TEMP%\tmp4b4.tmp
- %TEMP%\tmp4b3.tmp
- %TEMP%\tmp4a3.tmp
- %TEMP%\tmp4a2.tmp
- %TEMP%\tmp4a1.tmp
- %TEMP%\tmp490.tmp
- %TEMP%\tmp48f.tmp
- %TEMP%\tmp4c8.tmp
- %TEMP%\tmp48e.tmp
- %TEMP%\tmp47d.tmp
- %TEMP%\tmp47c.tmp
- %TEMP%\tmp47b.tmp
- %TEMP%\tmp46a.tmp
- %TEMP%\tmp469.tmp
- %TEMP%\tmp468.tmp
- %TEMP%\tmp467.tmp
- %TEMP%\tmp456.tmp
- %TEMP%\tmp455.tmp
- %TEMP%\tmp445.tmp
- %TEMP%\tmp47e.tmp
- %TEMP%\tmp4f8.tmp
- %TEMP%\tmp4f9.tmp
- %TEMP%\tmp509.tmp
- %TEMP%\tmp57e.tmp
- %TEMP%\tmp56d.tmp
- %TEMP%\tmp55d.tmp
- %TEMP%\tmp55c.tmp
- %TEMP%\tmp55b.tmp
- %TEMP%\tmp54a.tmp
- %TEMP%\tmp549.tmp
- %TEMP%\tmp548.tmp
- %TEMP%\tmp547.tmp
- %TEMP%\tmp546.tmp
- %TEMP%\tmp536.tmp
- %TEMP%\tmp535.tmp
- %TEMP%\tmp534.tmp
- %TEMP%\tmp533.tmp
- %TEMP%\tmp522.tmp
- %TEMP%\tmp521.tmp
- %TEMP%\tmp520.tmp
- %TEMP%\tmp51f.tmp
- %TEMP%\tmp51e.tmp
- %TEMP%\tmp50d.tmp
- %TEMP%\tmp50c.tmp
- %TEMP%\tmp50b.tmp
- %TEMP%\tmp50a.tmp
- %TEMP%\tmp434.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%low\gxoytrkaz-shm
- %TEMP%\tmpe953.tmp
- %TEMP%\tmpe952.tmp
- %TEMP%\tmpe941.tmp
- %TEMP%\tmpe940.tmp
- %TEMP%\tmpe930.tmp
- %TEMP%\tmpe92f.tmp
- %TEMP%\tmpe92e.tmp
- %TEMP%\tmpe92d.tmp
- %TEMP%\tmpe91c.tmp
- %TEMP%\tmpe91b.tmp
- %TEMP%\tmpe954.tmp
- %TEMP%\tmpe91a.tmp
- %TEMP%\tmpe918.tmp
- %TEMP%\tmpe917.tmp
- %TEMP%\tmpe906.tmp
- %TEMP%\tmpe905.tmp
- %TEMP%\tmpe904.tmp
- %TEMP%\tmpe8f4.tmp
- %TEMP%\tmpe8f3.tmp
- %TEMP%\tmpe8f2.tmp
- %TEMP%\tmpe8e1.tmp
- %TEMP%\tmpe8e0.tmp
- %TEMP%\tmpe919.tmp
- %TEMP%\tmpe955.tmp
- %TEMP%\tmpe965.tmp
- %TEMP%\tmpe966.tmp
- %LOCALAPPDATA%low\gxoytrkaz
- %LOCALAPPDATA%low\chd6ywevi-shm
- %LOCALAPPDATA%low\chd6ywevi
- %LOCALAPPDATA%low\firefox_urls.txt
- %LOCALAPPDATA%low\m2sgwlcms-shm
- %LOCALAPPDATA%low\m2sgwlcms
- %LOCALAPPDATA%low\fraqbc8ws-shm
- %LOCALAPPDATA%low\fraqbc8ws
- %TEMP%\tmpea7f.tmp
- %TEMP%\tmpea7e.tmp
- %TEMP%\tmpea1f.tmp
- %TEMP%\tmpea1e.tmp
- %TEMP%\tmpea1d.tmp
- %TEMP%\tmpe9af.tmp
- %TEMP%\tmpe9ae.tmp
- %TEMP%\tmpe99d.tmp
- %TEMP%\tmpe98d.tmp
- %TEMP%\tmpe97c.tmp
- %TEMP%\tmpe97b.tmp
- %TEMP%\tmpe97a.tmp
- %TEMP%\tmpe969.tmp
- %TEMP%\tmpe968.tmp
- %TEMP%\tmpe967.tmp
- %LOCALAPPDATA%low\machineinfo.txt
- %TEMP%\tmpe8df.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\tmpbf11.tmp
- %TEMP%\tmpbf39.tmp
- %TEMP%\tmpbf38.tmp
- %TEMP%\tmpbf37.tmp
- %TEMP%\tmpbf36.tmp
- %TEMP%\tmpbf25.tmp
- %TEMP%\tmpbf24.tmp
- %TEMP%\tmpbf14.tmp
- %TEMP%\tmpbf13.tmp
- %TEMP%\tmpbf12.tmp
- %TEMP%\tmpbf5c.tmp
- %TEMP%\tmpbf4a.tmp
- %TEMP%\tmpbf5b.tmp
- %TEMP%\tmpbeee.tmp
- %TEMP%\tmpbeed.tmp
- %TEMP%\tmpbeec.tmp
- %TEMP%\tmpbeeb.tmp
- %TEMP%\tmpbedb.tmp
- %TEMP%\tmpbeda.tmp
- %TEMP%\tmpbed9.tmp
- %TEMP%\tmpbed8.tmp
- %TEMP%\tmpbec7.tmp
- %TEMP%\tmpbeff.tmp
- %TEMP%\tmpbf5d.tmp
- %TEMP%\tmpc03f.tmp
- %TEMP%\tmpbec6.tmp
- %TEMP%\tmpbea5.tmp
- %TEMP%\tmpc02e.tmp
- %TEMP%\tmpc00e.tmp
- %TEMP%\tmpc00d.tmp
- %TEMP%\tmpbfbe.tmp
- %TEMP%\tmpbfad.tmp
- %TEMP%\tmpbfac.tmp
- %TEMP%\tmpbfab.tmp
- %TEMP%\tmpbf9b.tmp
- %TEMP%\tmpbf9a.tmp
- %TEMP%\tmpbf99.tmp
- %TEMP%\tmpbf98.tmp
- %TEMP%\tmpbf87.tmp
- %TEMP%\tmpbf86.tmp
- %TEMP%\tmpbf85.tmp
- %TEMP%\tmpbf84.tmp
- %TEMP%\tmpbf74.tmp
- %TEMP%\tmpbf73.tmp
- %TEMP%\tmpbf72.tmp
- %TEMP%\tmpbf71.tmp
- %TEMP%\tmpbf60.tmp
- %TEMP%\tmpbf5f.tmp
- %TEMP%\tmpbf5e.tmp
- %TEMP%\tmpbf00.tmp
- %TEMP%\tmp59e.tmp
- %TEMP%\tmpc159.tmp
- %TEMP%\tmpbe37.tmp
- %LOCALAPPDATA%low\3solbph71y
- %LOCALAPPDATA%low\x3cf3ednhm
- %LOCALAPPDATA%low\rqf69azbla
- %LOCALAPPDATA%low\rywtiizs2t
- %LOCALAPPDATA%low\1xvpfvjcrg
- %LOCALAPPDATA%low\fraqbc8wsa
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %LOCALAPPDATA%low\gxix4a2dre
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\5a36.exe
- %LOCALAPPDATA%low\sqlite3.dll
- %TEMP%\4eb1.exe
- %TEMP%\4731.exe
- %TEMP%\3c09.exe
- %TEMP%\3286.exe
- %TEMP%\14c8.exe
- %TEMP%\ede.exe
- %APPDATA%\urfjvsu
- %APPDATA%\ciafvib
- %TEMP%\6483.exe
- %LOCALAPPDATA%low\bbsqwy6yhk
- %LOCALAPPDATA%low\exuieaoeii
- %TEMP%\8352.tmp
- %TEMP%\tmpbe26.tmp
- %TEMP%\8744.tmp
- %TEMP%\tmpbe16.tmp
- %TEMP%\tmpbe05.tmp
- %TEMP%\tmpbdd5.tmp
- %TEMP%\tmpbdd4.tmp
- %TEMP%\tmpbdc4.tmp
- %TEMP%\tmpbda3.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
- %TEMP%\8794.tmp-shm
- %TEMP%\8794.tmp
- %TEMP%\8755.tmp
- %TEMP%\8705.tmp
- %TEMP%\8352.tmp-shm
- %TEMP%\8704.tmp
- %TEMP%\86b5.tmp
- %TEMP%\86a4.tmp
- %TEMP%\8684.tmp
- %TEMP%\8645.tmp
- %TEMP%\855a.tmp
- %TEMP%\853a.tmp
- %TEMP%\84fa.tmp
- %TEMP%\84da.tmp
- %TEMP%\8372.tmp
- %TEMP%\tmpbea6.tmp
- %LOCALAPPDATA%low\mohqkxkl0hv.zip
- %TEMP%\tmpc15a.tmp
- %TEMP%\tmpd115.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
- %TEMP%\tmpd401.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
- %TEMP%\tmpd2c8.tmp
- %TEMP%\tmpd2c7.tmp
- %TEMP%\tmpd2c6.tmp
- %TEMP%\tmpd2a6.tmp
- %TEMP%\tmpd2a5.tmp
- %TEMP%\tmpd285.tmp
- %TEMP%\tmpd284.tmp
- %TEMP%\tmpd264.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
- %TEMP%\tmpd441.tmp
- %TEMP%\tmpc189.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
- %TEMP%\tmpd263.tmp
- %TEMP%\tmpd114.tmp
- %TEMP%\tmpd252.tmp
- %TEMP%\tmpbf49.tmp
- %TEMP%\tmpd1b7.tmp
- %TEMP%\tmpd1b6.tmp
- %TEMP%\tmpd1a6.tmp
- %TEMP%\tmpd1a5.tmp
- %TEMP%\tmpd1a4.tmp
- %TEMP%\tmpd193.tmp
- %TEMP%\tmpd192.tmp
- %TEMP%\tmpd191.tmp
- %TEMP%\tmpd180.tmp
- %TEMP%\tmpd17f.tmp
- %TEMP%\tmpd1c8.tmp
- %TEMP%\tmpd17e.tmp
- %TEMP%\tmpd16d.tmp
- %TEMP%\tmpd16c.tmp
- %TEMP%\tmpd13c.tmp
- %TEMP%\tmpd13b.tmp
- %TEMP%\tmpd12a.tmp
- %TEMP%\tmpd129.tmp
- %TEMP%\tmpd128.tmp
- %TEMP%\tmpd118.tmp
- %TEMP%\tmpd117.tmp
- %TEMP%\tmpd116.tmp
- %TEMP%\tmpd17d.tmp
- %TEMP%\tmpd1c9.tmp
- %TEMP%\tmpd1ca.tmp
- %TEMP%\tmpd1da.tmp
- %TEMP%\tmpd24f.tmp
- %TEMP%\tmpd23e.tmp
- %TEMP%\tmpd23d.tmp
- %TEMP%\tmpd23c.tmp
- %TEMP%\tmpd23b.tmp
- %TEMP%\tmpd23a.tmp
- %TEMP%\tmpd22a.tmp
- %TEMP%\tmpd229.tmp
- %TEMP%\tmpd228.tmp
- %TEMP%\tmpd227.tmp
- %TEMP%\tmpd216.tmp
- %TEMP%\tmpd215.tmp
- %TEMP%\tmpd214.tmp
- %TEMP%\tmpd213.tmp
- %TEMP%\tmpd203.tmp
- %TEMP%\tmpd202.tmp
- %TEMP%\tmpd201.tmp
- %TEMP%\tmpd200.tmp
- %TEMP%\tmpd1ff.tmp
- %TEMP%\tmpd1ee.tmp
- %TEMP%\tmpd1dd.tmp
- %TEMP%\tmpd1dc.tmp
- %TEMP%\tmpd1db.tmp
- %TEMP%\tmpd251.tmp
- %TEMP%\tmp59f.tmp
- %APPDATA%\ciafvib
- %APPDATA%\urfjvsu
- %LOCALAPPDATA%low\fraqbc8wsa
- %TEMP%\tmpe99d.tmp
- %TEMP%\tmpe97b.tmp
- %TEMP%\tmpe97c.tmp
- %TEMP%\tmpe969.tmp
- %TEMP%\tmpe97a.tmp
- %TEMP%\tmpe967.tmp
- %TEMP%\tmpe968.tmp
- %TEMP%\tmpe965.tmp
- %TEMP%\tmpe966.tmp
- %TEMP%\tmpe954.tmp
- %TEMP%\tmpe955.tmp
- %TEMP%\tmpe952.tmp
- %TEMP%\tmpe953.tmp
- %TEMP%\tmpe940.tmp
- %TEMP%\tmpe941.tmp
- %TEMP%\tmpe92f.tmp
- %TEMP%\tmpe930.tmp
- %TEMP%\tmpe92d.tmp
- %TEMP%\tmpe92e.tmp
- %TEMP%\tmpe91b.tmp
- %TEMP%\tmpe91c.tmp
- %TEMP%\tmpe98d.tmp
- %TEMP%\tmpe9af.tmp
- %TEMP%\tmpe9ae.tmp
- %TEMP%\tmpea1d.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
- %LOCALAPPDATA%low\mohqkxkl0hv.zip
- %LOCALAPPDATA%low\machineinfo.txt
- %LOCALAPPDATA%low\firefox_urls.txt
- %LOCALAPPDATA%low\gxoytrkaz-shm
- %LOCALAPPDATA%low\gxoytrkaz
- %LOCALAPPDATA%low\chd6ywevi
- %LOCALAPPDATA%low\chd6ywevi-shm
- %LOCALAPPDATA%low\m2sgwlcms
- %LOCALAPPDATA%low\m2sgwlcms-shm
- %LOCALAPPDATA%low\fraqbc8ws
- %LOCALAPPDATA%low\fraqbc8ws-shm
- %TEMP%\tmpea7f.tmp
- %TEMP%\tmpea7e.tmp
- %TEMP%\tmpea1f.tmp
- %TEMP%\tmpea1e.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\tmpe919.tmp
- %TEMP%\tmpe91a.tmp
- %TEMP%\tmpe917.tmp
- %TEMP%\tmpe850.tmp
- %TEMP%\tmpe84f.tmp
- %TEMP%\tmpe84e.tmp
- %TEMP%\tmpe84d.tmp
- %TEMP%\tmpe82d.tmp
- %TEMP%\tmpe82c.tmp
- %TEMP%\tmpe283.tmp
- %TEMP%\tmpe272.tmp
- %TEMP%\tmpe233.tmp
- %TEMP%\tmpe222.tmp
- %TEMP%\tmpe212.tmp
- %TEMP%\tmpe1f1.tmp
- %TEMP%\tmpe201.tmp
- %TEMP%\tmpe1df.tmp
- %TEMP%\tmpe1e0.tmp
- %TEMP%\tmpe1be.tmp
- %TEMP%\tmpe1bf.tmp
- %TEMP%\tmpe1bc.tmp
- %TEMP%\tmpe1bd.tmp
- %TEMP%\tmpe17b.tmp
- %TEMP%\tmpe1ab.tmp
- %TEMP%\tmpe851.tmp
- %TEMP%\tmpe852.tmp
- %TEMP%\tmpe874.tmp
- %TEMP%\tmpe873.tmp
- %TEMP%\tmpe905.tmp
- %TEMP%\tmpe906.tmp
- %TEMP%\tmpe8f4.tmp
- %TEMP%\tmpe904.tmp
- %TEMP%\tmpe8f2.tmp
- %TEMP%\tmpe8f3.tmp
- %TEMP%\tmpe8e0.tmp
- %TEMP%\tmpe8e1.tmp
- %TEMP%\tmpe8de.tmp
- %TEMP%\tmpe8df.tmp
- %TEMP%\tmpe8ce.tmp
- %TEMP%\tmpe8cd.tmp
- %TEMP%\tmpe8ab.tmp
- %TEMP%\tmpe8bc.tmp
- %TEMP%\tmpe8a9.tmp
- %TEMP%\tmpe8aa.tmp
- %TEMP%\tmpe898.tmp
- %TEMP%\tmpe899.tmp
- %TEMP%\tmpe896.tmp
- %TEMP%\tmpe897.tmp
- %TEMP%\tmpe884.tmp
- %TEMP%\tmpe885.tmp
- %TEMP%\tmpe918.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
- %TEMP%\tmp59f.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\tmp4c7.tmp
- %TEMP%\tmp4c8.tmp
- %TEMP%\tmp4b5.tmp
- %TEMP%\tmp4b6.tmp
- %TEMP%\tmp4b3.tmp
- %TEMP%\tmp4b4.tmp
- %TEMP%\tmp4a2.tmp
- %TEMP%\tmp4a3.tmp
- %TEMP%\tmp490.tmp
- %TEMP%\tmp4a1.tmp
- %TEMP%\tmp48e.tmp
- %TEMP%\tmp48f.tmp
- %TEMP%\tmp47d.tmp
- %TEMP%\tmp47e.tmp
- %TEMP%\tmp47b.tmp
- %TEMP%\tmp47c.tmp
- %TEMP%\tmp469.tmp
- %TEMP%\tmp46a.tmp
- %TEMP%\tmp467.tmp
- %TEMP%\tmp468.tmp
- %TEMP%\tmp455.tmp
- %TEMP%\tmp4f9.tmp
- %TEMP%\tmp4f8.tmp
- %TEMP%\tmp50a.tmp
- %TEMP%\tmp509.tmp
- %TEMP%\tmp56d.tmp
- %TEMP%\tmp57e.tmp
- %TEMP%\tmp55c.tmp
- %TEMP%\tmp55d.tmp
- %TEMP%\tmp54a.tmp
- %TEMP%\tmp55b.tmp
- %TEMP%\tmp548.tmp
- %TEMP%\tmp549.tmp
- %TEMP%\tmp546.tmp
- %TEMP%\tmp547.tmp
- %TEMP%\tmp536.tmp
- %TEMP%\tmp535.tmp
- %TEMP%\tmp533.tmp
- %TEMP%\tmp534.tmp
- %TEMP%\tmp521.tmp
- %TEMP%\tmp522.tmp
- %TEMP%\tmp51f.tmp
- %TEMP%\tmp520.tmp
- %TEMP%\tmp50d.tmp
- %TEMP%\tmp51e.tmp
- %TEMP%\tmp50b.tmp
- %TEMP%\tmp50c.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\tmpe179.tmp
- %TEMP%\tmp434.tmp
- %TEMP%\tmp445.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%low\sqlite3.dll
- %TEMP%\tmp456.tmp
- %TEMP%\tmpe17a.tmp
- %TEMP%\tmpd441.tmp
- %TEMP%\tmpbf87.tmp
- %TEMP%\tmpbf84.tmp
- %TEMP%\tmpbf85.tmp
- %TEMP%\tmpbf73.tmp
- %TEMP%\tmpbf74.tmp
- %TEMP%\tmpbf71.tmp
- %TEMP%\tmpbf72.tmp
- %TEMP%\tmpbf5f.tmp
- %TEMP%\tmpbf60.tmp
- %TEMP%\tmpbf5d.tmp
- %TEMP%\tmpbf5e.tmp
- %TEMP%\tmpbf5b.tmp
- %TEMP%\tmpbf5c.tmp
- %TEMP%\tmpbf49.tmp
- %TEMP%\tmpbf4a.tmp
- %TEMP%\tmpbf38.tmp
- %TEMP%\tmpbf39.tmp
- %TEMP%\tmpbf36.tmp
- %TEMP%\tmpbf37.tmp
- %TEMP%\tmpbf24.tmp
- %TEMP%\tmpbf25.tmp
- %TEMP%\tmpbf86.tmp
- %TEMP%\tmpbf99.tmp
- %TEMP%\tmpbf98.tmp
- %TEMP%\tmpbf9b.tmp
- %TEMP%\tmpd13b.tmp
- %TEMP%\tmpd13c.tmp
- %TEMP%\tmpd12a.tmp
- %TEMP%\tmpd129.tmp
- %TEMP%\tmpd128.tmp
- %TEMP%\tmpd118.tmp
- %TEMP%\tmpd117.tmp
- %TEMP%\tmpd116.tmp
- %TEMP%\tmpd115.tmp
- %TEMP%\tmpd114.tmp
- %TEMP%\tmpc15a.tmp
- %TEMP%\tmpc189.tmp
- %TEMP%\tmpc159.tmp
- %TEMP%\tmpc02e.tmp
- %TEMP%\tmpc03f.tmp
- %TEMP%\tmpc00d.tmp
- %TEMP%\tmpc00e.tmp
- %TEMP%\tmpbfad.tmp
- %TEMP%\tmpbfbe.tmp
- %TEMP%\tmpbfab.tmp
- %TEMP%\tmpbfac.tmp
- %TEMP%\tmpbf9a.tmp
- %TEMP%\tmpd16d.tmp
- %TEMP%\tmpbf13.tmp
- %TEMP%\tmpbf14.tmp
- %TEMP%\tmpbf11.tmp
- %TEMP%\8705.tmp
- %TEMP%\8704.tmp
- %TEMP%\86b5.tmp
- %TEMP%\86a4.tmp
- %TEMP%\8684.tmp
- %TEMP%\8645.tmp
- %TEMP%\855a.tmp
- %TEMP%\853a.tmp
- %TEMP%\84fa.tmp
- %TEMP%\84da.tmp
- %TEMP%\8372.tmp
- %TEMP%\8352.tmp
- %TEMP%\8352.tmp-shm
- %LOCALAPPDATA%low\bbsqwy6yhk
- %LOCALAPPDATA%low\gxix4a2dre
- %LOCALAPPDATA%low\exuieaoeii
- %LOCALAPPDATA%low\3solbph71y
- %LOCALAPPDATA%low\x3cf3ednhm
- %LOCALAPPDATA%low\rqf69azbla
- %LOCALAPPDATA%low\rywtiizs2t
- %LOCALAPPDATA%low\1xvpfvjcrg
- %TEMP%\8744.tmp
- %TEMP%\8755.tmp
- %TEMP%\8794.tmp-shm
- %TEMP%\8794.tmp
- %TEMP%\tmpbeff.tmp
- %TEMP%\tmpbf00.tmp
- %TEMP%\tmpbeed.tmp
- %TEMP%\tmpbeee.tmp
- %TEMP%\tmpbeeb.tmp
- %TEMP%\tmpbeec.tmp
- %TEMP%\tmpbeda.tmp
- %TEMP%\tmpbedb.tmp
- %TEMP%\tmpbed8.tmp
- %TEMP%\tmpbed9.tmp
- %TEMP%\tmpbec7.tmp
- %TEMP%\tmpbec6.tmp
- %TEMP%\tmpbea5.tmp
- %TEMP%\tmpbea6.tmp
- %TEMP%\tmpbe37.tmp
- %TEMP%\tmpbe26.tmp
- %TEMP%\tmpbe16.tmp
- %TEMP%\tmpbe05.tmp
- %TEMP%\tmpbdd5.tmp
- %TEMP%\tmpbdd4.tmp
- %TEMP%\tmpbdc4.tmp
- %TEMP%\tmpbda3.tmp
- %TEMP%\tmpbf12.tmp
- %TEMP%\tmpd23d.tmp
- %TEMP%\tmpe169.tmp
- %TEMP%\tmpd17d.tmp
- %TEMP%\tmpe0a0.tmp
- %TEMP%\tmpe0a1.tmp
- %TEMP%\tmpe08f.tmp
- %TEMP%\tmpe090.tmp
- %TEMP%\tmpe07d.tmp
- %TEMP%\tmpe07e.tmp
- %TEMP%\tmpe06b.tmp
- %TEMP%\tmpe06c.tmp
- %TEMP%\tmpe069.tmp
- %TEMP%\tmpe06a.tmp
- %TEMP%\tmpe048.tmp
- %TEMP%\tmpe059.tmp
- %TEMP%\tmpe038.tmp
- %TEMP%\tmpe037.tmp
- %TEMP%\tmpe026.tmp
- %TEMP%\tmpe025.tmp
- %TEMP%\tmpe024.tmp
- %TEMP%\tmpe023.tmp
- %TEMP%\tmpe022.tmp
- %TEMP%\tmpe011.tmp
- %LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
- %TEMP%\tmpe0e2.tmp
- %TEMP%\tmpe0e1.tmp
- %TEMP%\tmpe0e4.tmp
- %TEMP%\tmpe0e3.tmp
- %TEMP%\tmpe166.tmp
- %TEMP%\tmpe167.tmp
- %TEMP%\tmpe154.tmp
- %TEMP%\tmpe155.tmp
- %TEMP%\tmpe152.tmp
- %TEMP%\tmpe153.tmp
- %TEMP%\tmpe141.tmp
- %TEMP%\tmpe142.tmp
- %TEMP%\tmpe13f.tmp
- %TEMP%\tmpe140.tmp
- %TEMP%\tmpe12e.tmp
- %TEMP%\tmpe12d.tmp
- %TEMP%\tmpe12b.tmp
- %TEMP%\tmpe12c.tmp
- %TEMP%\tmpe119.tmp
- %TEMP%\tmpe11a.tmp
- %TEMP%\tmpe117.tmp
- %TEMP%\tmpe118.tmp
- %TEMP%\tmpe106.tmp
- %TEMP%\tmpe107.tmp
- %TEMP%\tmpe0f4.tmp
- %TEMP%\tmpe0f5.tmp
- %TEMP%\tmpd17e.tmp
- %TEMP%\tmpe168.tmp
- %TEMP%\tmpd401.tmp
- %TEMP%\tmpd2c8.tmp
- %TEMP%\tmpd202.tmp
- %TEMP%\tmpd1ff.tmp
- %TEMP%\tmpd200.tmp
- %TEMP%\tmpd1dd.tmp
- %TEMP%\tmpd1ee.tmp
- %TEMP%\tmpd1db.tmp
- %TEMP%\tmpd1dc.tmp
- %TEMP%\tmpd1ca.tmp
- %TEMP%\tmpd1da.tmp
- %TEMP%\tmpd1c8.tmp
- %TEMP%\tmpd1c9.tmp
- %TEMP%\tmpd1b6.tmp
- %TEMP%\tmpd1b7.tmp
- %TEMP%\tmpd1a5.tmp
- %TEMP%\tmpd1a6.tmp
- %TEMP%\tmpd193.tmp
- %TEMP%\tmpd1a4.tmp
- %TEMP%\tmpd191.tmp
- %TEMP%\tmpd192.tmp
- %TEMP%\tmpd17f.tmp
- %TEMP%\tmpd180.tmp
- %TEMP%\tmpd201.tmp
- %TEMP%\tmpd213.tmp
- %TEMP%\tmpd203.tmp
- %TEMP%\tmpd215.tmp
- %TEMP%\tmpd2c6.tmp
- %TEMP%\tmpd2a5.tmp
- %TEMP%\tmpd2a6.tmp
- %TEMP%\tmpd284.tmp
- %TEMP%\tmpd285.tmp
- %TEMP%\tmpd263.tmp
- %TEMP%\tmpd264.tmp
- %TEMP%\tmpd251.tmp
- %TEMP%\tmpd252.tmp
- %TEMP%\tmpd24f.tmp
- %TEMP%\tmpd16c.tmp
- %TEMP%\tmpd250.tmp
- %TEMP%\tmpd23e.tmp
- %TEMP%\tmpd23b.tmp
- %TEMP%\tmpd23c.tmp
- %TEMP%\tmpd22a.tmp
- %TEMP%\tmpd23a.tmp
- %TEMP%\tmpd228.tmp
- %TEMP%\tmpd229.tmp
- %TEMP%\tmpd216.tmp
- %TEMP%\tmpd227.tmp
- %TEMP%\tmpd214.tmp
- %TEMP%\tmpd2c7.tmp
- %TEMP%\tmp59e.tmp
- 'be######neprihoditodna.top':443
- '17#.#0.40.83':7710
- '10#.#34.38.124':35200
- '99###########51-service10020125999080321.xyz':80
- 'ap#.ip.sb':443
- '17#.#0.40.164':62824
- http://99###########51-service10020125999080321.xyz/raccon.exe
- http://99###########51-service10020125999080321.xyz/reestr.exe
- http://99###########51-service10020125999080321.xyz/
- http://17#.##.40.164:62824/ via 17#.#0.40.164
- http://ga##a.xyz//
- http://jb##ef.ga/
- http://17#.##.40.83:7710// via 17#.#0.40.83
- http://10#.###.38.124:35200// via 10#.#34.38.124
- DNS ASK 99###########older1002002131-service1002.space
- DNS ASK b.##llo8.ru
- DNS ASK ga##a.xyz
- DNS ASK be######neprihoditodna.top
- DNS ASK te##te.in
- DNS ASK 99###########51-service10020125999080321.xyz
- DNS ASK 99############1-service10020125999080321.website
- DNS ASK 99###########71-service100201dom25999080321.ru
- DNS ASK 99###########t1341-service10020125999080321.ru
- DNS ASK 99############2671-service10020125999080321.online
- DNS ASK 99############5671-service10020125999080321.tech
- DNS ASK 99###########13461-service10020125999080321.net
- DNS ASK 99############4781-service10020125999080321.info
- DNS ASK 99###########13561-service10020125999080321.su
- DNS ASK 99###########t3481-service10020125999080321.ru
- DNS ASK 99############3531-service1002012425999080321.ru
- DNS ASK 99############34831-service10020125999080321.space
- DNS ASK 99############46831-service10020125999080321.space
- DNS ASK 99############47831-service10020125999080321.space
- DNS ASK 99############36831-service10020125999080321.space
- DNS ASK 99############25831-service10020125999080321.space
- DNS ASK 99###########older33417-012425999080321.space
- DNS ASK 99###########older1002002531-service1002.space
- DNS ASK 99###########older1002002431-service1002.space
- DNS ASK 99##########folder3100231-service1002.space
- DNS ASK 99###########older1002002231-service1002.space
- DNS ASK ap#.ip.sb
- DNS ASK jb##ef.ga
- '%TEMP%\ede.exe'
- '%TEMP%\14c8.exe'
- '%TEMP%\3286.exe'
- '%TEMP%\3c09.exe'
- '%TEMP%\4731.exe'
- '%TEMP%\4eb1.exe'
- '%TEMP%\5a36.exe'
- '%TEMP%\6483.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'