API tools faq
paste
paladin316

Exes_0eb855f125ee20f79cefd28363fd9362_exe_2019-08-05_09_30.txt

paladin316
Aug 5th, 2019
2,369
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 116.84 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_0eb855f125ee20f79cefd28363fd9362.exe"
  7. * File Size: 1954816
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "edfc93b0f9884f30f4bcc53dd7006a4b48e0302875dd42f70f099a0a95831c46"
  10. * MD5: "0eb855f125ee20f79cefd28363fd9362"
  11. * SHA1: "c5db1d34bf089c6febd17bfd6cce60f4a305a4c9"
  12. * SHA512: "0a4edd52ad6ac6797bdaed0759efc4172fdc7023e3834cd03a6ecb52eb881bbc9823b077591a365235e19786e10d5baadc6baa10834127548874f1cffd8425a2"
  13. * CRC32: "BACDB015"
  14. * SSDEEP: "24576:POpCo7yqxeyszkKSbYcMCg+aBJwUCHsZ2pqtmH7RGSLATWM10mkSk4zUCToZ3fgW:DCyq8SNMp9JwvMZ2pqgb4jTHUS9Gpf"
  15.  
  16. * Process Execution:
  17. "Exes_0eb855f125ee20f79cefd28363fd9362.exe",
  18. "lvQ99Up.exe",
  19. "explorer.exe",
  20. "hsmqzv.fcs",
  21. "cmd.exe",
  22. "iqrkkp.yre",
  23. "services.exe",
  24. "taskhost.exe",
  25. "svchost.exe",
  26. "convert.exe",
  27. "unsecapp.exe",
  28. "WmiPrvSE.exe",
  29. "find.exe",
  30. "find.exe",
  31. "dllhost.exe",
  32. "icacls.exe",
  33. "pcaui.exe",
  34. "dllhost.exe",
  35. "svchost.exe",
  36. "taskhost.exe",
  37. "icacls.exe",
  38. "ctfnon.exe",
  39. "wsmprovhost.exe",
  40. "cmd.exe",
  41. "RdyFtm.exe"
  42.  
  43.  
  44. * Executed Commands:
  45. "C:/Windows/fc7bf6/lvQ99Up.exe /runp2p:C:/Windows/fc7bf6/x9reg8Y.dll",
  46. "c:\\windows\\hsmqzv.fcs /sid:b5044a530f25494fb3d9b3a2b224966f /mac:18c086cd4732 /uid:209575348.0 /plat:icafeads",
  47. "c:/windows/zm2pl/iqrkkp.yre /s66 /klwxs /delcookie /mylock /home:https://www.2345.com/?90162-01791 /sid:b5044a530f25494fb3d9b3a2b224966f /mac:18c086cd4732 /uid:209575348.0 /plat:icafeads",
  48. "cmd.exe /c del /q c:\\windows\\hsmqzv.fcs",
  49. "C:\\Windows\\run.bat",
  50. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\RdyFtm.exe",
  51. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  52. "C:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding",
  53. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  54.  
  55.  
  56. * Signatures Detected:
  57.  
  58. "Description": "Creates RWX memory",
  59. "Details":
  60.  
  61.  
  62. "Description": "Possible date expiration check, exits too soon after checking local time",
  63. "Details":
  64.  
  65. "process": "Exes_0eb855f125ee20f79cefd28363fd9362.exe, PID 696"
  66.  
  67.  
  68.  
  69.  
  70. "Description": "Repeatedly searches for a not-found browser, may want to run with startbrowser=1 option",
  71. "Details":
  72.  
  73. "ClassName": "Chrome_WidgetWin_1"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  79. "Details":
  80.  
  81. "IP": "125.211.204.241:80"
  82.  
  83.  
  84. "IP": "218.11.11.246:80"
  85.  
  86.  
  87. "IP": "157.185.169.223:80"
  88.  
  89.  
  90. "IP": "221.204.166.36:80"
  91.  
  92.  
  93. "IP": "1.189.213.92:80"
  94.  
  95.  
  96. "IP": "220.194.79.73:80"
  97.  
  98.  
  99. "IP": "123.206.222.176:80"
  100.  
  101.  
  102.  
  103.  
  104. "Description": "Loads a driver",
  105. "Details":
  106.  
  107. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\dnihfzt"
  108.  
  109.  
  110. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\dnihfzt"
  111.  
  112.  
  113. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\dnihfzt"
  114.  
  115.  
  116. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\dnihfzt"
  117.  
  118.  
  119. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\dnihfzt"
  120.  
  121.  
  122. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\eojigaz"
  123.  
  124.  
  125. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\eojigaz"
  126.  
  127.  
  128. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\eojigaz"
  129.  
  130.  
  131. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\eojigaz"
  132.  
  133.  
  134. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\eojigaz"
  135.  
  136.  
  137.  
  138.  
  139. "Description": "A named pipe was used for inter-process communication",
  140. "Details":
  141.  
  142. "Creates": "RdyFtm.exe(2220) Created Named Pipe getfuncaddrpipe"
  143.  
  144.  
  145. "Interacts": "wsmprovhost.exe(1896) writes/reads data to Named Pipe getfuncaddrpipe"
  146.  
  147.  
  148. "Interacts": "RdyFtm.exe(2220) reads/writes data to Named Pipe getfuncaddrpipe"
  149.  
  150.  
  151.  
  152.  
  153. "Description": "Starts servers listening on 0.0.0.0:11517, 0.0.0.0:8805, 0.0.0.0:8041",
  154. "Details":
  155.  
  156.  
  157. "Description": "Expresses interest in specific running processes",
  158. "Details":
  159.  
  160. "process": "SearchIndexer.exe"
  161.  
  162.  
  163. "process": "System"
  164.  
  165.  
  166. "process": "explorer.exe"
  167.  
  168.  
  169. "process": "svchost.exe"
  170.  
  171.  
  172. "process": "taskhost.exe"
  173.  
  174.  
  175. "process": "armsvc.exe"
  176.  
  177.  
  178. "process": "winlogon.exe"
  179.  
  180.  
  181.  
  182.  
  183. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  184. "Details":
  185.  
  186.  
  187. "Description": "A process created a hidden window",
  188. "Details":
  189.  
  190. "Process": "hsmqzv.fcs -> cmd.exe"
  191.  
  192.  
  193.  
  194.  
  195. "Description": "Drops a binary and executes it",
  196. "Details":
  197.  
  198. "binary": "C:\\Windows\\zM2pL\\iqrkkp.yre"
  199.  
  200.  
  201. "binary": "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\RdyFtm.exe"
  202.  
  203.  
  204. "binary": "C:\\Windows\\hsmqzv.fcs"
  205.  
  206.  
  207. "binary": "C:\\Windows\\fc7bf6\\lvQ99Up.exe"
  208.  
  209.  
  210.  
  211.  
  212. "Description": "Performs some HTTP requests",
  213. "Details":
  214.  
  215. "url": "http://np2p.inibin.com/icafeads/?usr=209575348.0&mac=18c086cd4732&ver=2,2,2,4131&winos=64"
  216.  
  217.  
  218. "url": "http://next.91xiaba.com/plat/rkhlI5GJmkQWabug"
  219.  
  220.  
  221. "url": "http://next.91xiaba.com/plat/REOY6Fc6NFTBNN5c"
  222.  
  223.  
  224. "url": "http://next.91xiaba.com/plat/cbba13d8c13"
  225.  
  226.  
  227. "url": "http://next.91xiaba.com/plat/48fd4b0a452"
  228.  
  229.  
  230. "url": "http://next.91xiaba.com/plat/GYy5ztU9gaN26jEb"
  231.  
  232.  
  233. "url": "http://next.91xiaba.com/plat/OPo6CIrcHoNu8M9m"
  234.  
  235.  
  236. "url": "http://next.91xiaba.com/plat/oxQnEKn0NFR9NXeA"
  237.  
  238.  
  239. "url": "http://ln.adsxz.com/cool/Urls.ini"
  240.  
  241.  
  242. "url": "http://ln.adsxz.com/cool/pt/Jason.ini"
  243.  
  244.  
  245. "url": "http://pro.icafe66.com/as/ass.txt"
  246.  
  247.  
  248. "url": "http://pro.icafe66.com/yunzb/qd0/jm.json"
  249.  
  250.  
  251. "url": "http://log.soomeng.com/yzb/?mac=18c086cd4732&uid=209575348.0&plat=icafeads&tm=1"
  252.  
  253.  
  254. "url": "http://log.uinfo.soomeng.com/mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIwRURBMjNFMm4xOEMwODZDRDQ3MzJ8Mnww"
  255.  
  256.  
  257. "url": "http://ln.adsxz.com/cool/pt/Jason1.ini"
  258.  
  259.  
  260. "url": "http://log.uinfo.soomeng.com/mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIxMTQyRjA0Nm4xOEMwODZDRDQ3MzJ8Mnww"
  261.  
  262.  
  263. "url": "http://log.soomeng.com/home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=1"
  264.  
  265.  
  266. "url": "http://log.soomeng.com/home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=2"
  267.  
  268.  
  269.  
  270.  
  271. "Description": "The binary likely contains encrypted or compressed data.",
  272. "Details":
  273.  
  274. "section": "name: .vmp1, entropy: 7.85, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001dc800, virtual_size: 0x001dc7f0"
  275.  
  276.  
  277.  
  278.  
  279. "Description": "The executable is likely packed with VMProtect",
  280. "Details":
  281.  
  282. "section":
  283. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  284. "characteristics_raw": "0xe0000060",
  285. "entropy": "0.00",
  286. "name": ".vmp0",
  287. "raw_address": "0x00000000",
  288. "size_of_data": "0x00000000",
  289. "virtual_address": "0x0002c000",
  290. "virtual_size": "0x001ab123"
  291.  
  292.  
  293.  
  294.  
  295.  
  296. "Description": "Detects Sandboxie through the presence of a library",
  297. "Details":
  298.  
  299.  
  300. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  301. "Details":
  302.  
  303. "Process": "Exes_0eb855f125ee20f79cefd28363fd9362.exe (696)"
  304.  
  305.  
  306.  
  307.  
  308. "Description": "Code injection with CreateRemoteThread in a remote process",
  309. "Details":
  310.  
  311. "Injection": "lvQ99Up.exe(2316) -> explorer.exe(2044)"
  312.  
  313.  
  314.  
  315.  
  316. "Description": "Forces a created process to be the child of an unrelated process",
  317. "Details":
  318.  
  319.  
  320. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  321. "Details":
  322.  
  323. "Process": "dllhost.exe tried to sleep 729 seconds, actually delayed analysis time by 0 seconds"
  324.  
  325.  
  326. "Process": "find.exe tried to sleep 740 seconds, actually delayed analysis time by 0 seconds"
  327.  
  328.  
  329. "Process": "wsmprovhost.exe tried to sleep 2987 seconds, actually delayed analysis time by 0 seconds"
  330.  
  331.  
  332. "Process": "icacls.exe tried to sleep 1087 seconds, actually delayed analysis time by 0 seconds"
  333.  
  334.  
  335. "Process": "explorer.exe tried to sleep 2017 seconds, actually delayed analysis time by 0 seconds"
  336.  
  337.  
  338. "Process": "convert.exe tried to sleep 394 seconds, actually delayed analysis time by 0 seconds"
  339.  
  340.  
  341. "Process": "pcaui.exe tried to sleep 364 seconds, actually delayed analysis time by 0 seconds"
  342.  
  343.  
  344. "Process": "svchost.exe tried to sleep 600 seconds, actually delayed analysis time by 0 seconds"
  345.  
  346.  
  347. "Process": "taskhost.exe tried to sleep 640 seconds, actually delayed analysis time by 0 seconds"
  348.  
  349.  
  350. "Process": "WmiPrvSE.exe tried to sleep 420 seconds, actually delayed analysis time by 0 seconds"
  351.  
  352.  
  353.  
  354.  
  355. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  356. "Details":
  357.  
  358. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 6351011 times"
  359.  
  360.  
  361.  
  362.  
  363. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  364. "Details":
  365.  
  366. "regkeyval": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache"
  367.  
  368.  
  369.  
  370.  
  371. "Description": "Network activity contains more than one unique useragent.",
  372. "Details":
  373.  
  374. "Process": "icacls.exe"
  375.  
  376.  
  377. "User-Agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)"
  378.  
  379.  
  380. "Process": "icacls.exe"
  381.  
  382.  
  383. "User-Agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)"
  384.  
  385.  
  386.  
  387.  
  388. "Description": "Installs itself for autorun at Windows startup",
  389. "Details":
  390.  
  391. "service name": "ZUrMDQv.sys"
  392.  
  393.  
  394. "service path": "c:/windows/system32/ZUrMDQv.sys"
  395.  
  396.  
  397. "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\eojigaz\\ImagePath"
  398.  
  399.  
  400. "data": "\\??\\C:\\windows\\system32\\wypanms.sys"
  401.  
  402.  
  403.  
  404.  
  405. "Description": "Creates a hidden or system file",
  406. "Details":
  407.  
  408. "file": "C:\\Windows\\System32\\lz_scby.txt"
  409.  
  410.  
  411. "file": "C:\\Windows\\fc7bf6\\"
  412.  
  413.  
  414. "file": "C:\\Users\\user\\AppData\\Local\\jBkaB.dat"
  415.  
  416.  
  417. "file": "C:\\Users\\user\\AppData\\Local\\sccon.ini"
  418.  
  419.  
  420. "file": "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\"
  421.  
  422.  
  423. "file": "C:\\Users\\user\\AppData\\Roaming\\Tencent\\QQ\\config.ini"
  424.  
  425.  
  426. "file": "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\index.dat"
  427.  
  428.  
  429. "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat"
  430.  
  431.  
  432. "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR"
  433.  
  434.  
  435. "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\desktop.ini"
  436.  
  437.  
  438.  
  439.  
  440. "Description": "File has been identified by 45 Antiviruses on VirusTotal as malicious",
  441. "Details":
  442.  
  443. "Bkav": "HW32.Packed."
  444.  
  445.  
  446. "MicroWorld-eScan": "Gen:Variant.Ursu.227819"
  447.  
  448.  
  449. "FireEye": "Generic.mg.0eb855f125ee20f7"
  450.  
  451.  
  452. "McAfee": "Artemis!0EB855F125EE"
  453.  
  454.  
  455. "Cylance": "Unsafe"
  456.  
  457.  
  458. "CrowdStrike": "win/malicious_confidence_90% (W)"
  459.  
  460.  
  461. "K7GW": "Riskware ( 0040eff71 )"
  462.  
  463.  
  464. "K7AntiVirus": "Riskware ( 0040eff71 )"
  465.  
  466.  
  467. "TrendMicro": "TROJ_GEN.R060C0RH319"
  468.  
  469.  
  470. "Baidu": "Win32.Packed.VMProtect.a"
  471.  
  472.  
  473. "Symantec": "Trojan.Gen.MBT"
  474.  
  475.  
  476. "APEX": "Malicious"
  477.  
  478.  
  479. "GData": "Gen:Variant.Ursu.227819"
  480.  
  481.  
  482. "Kaspersky": "Trojan-Dropper.Win32.Injector.unkf"
  483.  
  484.  
  485. "BitDefender": "Gen:Variant.Ursu.227819"
  486.  
  487.  
  488. "NANO-Antivirus": "Trojan.Win32.Inject3.fuuxuf"
  489.  
  490.  
  491. "Avast": "Win32:Malware-gen"
  492.  
  493.  
  494. "Tencent": "Win32.Trojan.Gen.Jmm"
  495.  
  496.  
  497. "Endgame": "malicious (high confidence)"
  498.  
  499.  
  500. "Emsisoft": "Gen:Variant.Ursu.227819 (B)"
  501.  
  502.  
  503. "F-Secure": "Trojan.TR/Black.Gen2"
  504.  
  505.  
  506. "DrWeb": "Trojan.Inject3.22186"
  507.  
  508.  
  509. "Invincea": "heuristic"
  510.  
  511.  
  512. "McAfee-GW-Edition": "BehavesLike.Win32.Upatre.tc"
  513.  
  514.  
  515. "Trapmine": "malicious.high.ml.score"
  516.  
  517.  
  518. "Sophos": "Mal/VMProtBad-A"
  519.  
  520.  
  521. "Ikarus": "Trojan.Win32.VMProtect"
  522.  
  523.  
  524. "Avira": "TR/Black.Gen2"
  525.  
  526.  
  527. "MAX": "malware (ai score=81)"
  528.  
  529.  
  530. "Microsoft": "Trojan:Win32/Tiggre!rfn"
  531.  
  532.  
  533. "Arcabit": "Trojan.Ursu.D379EB"
  534.  
  535.  
  536. "ZoneAlarm": "Trojan-Dropper.Win32.Injector.unkf"
  537.  
  538.  
  539. "AhnLab-V3": "Malware/Win32.Generic.C2475889"
  540.  
  541.  
  542. "Acronis": "suspicious"
  543.  
  544.  
  545. "VBA32": "TrojanPSW.Coins"
  546.  
  547.  
  548. "ALYac": "Gen:Variant.Ursu.227819"
  549.  
  550.  
  551. "Ad-Aware": "Gen:Variant.Ursu.227819"
  552.  
  553.  
  554. "ESET-NOD32": "a variant of Win32/Packed.VMProtect.ABD"
  555.  
  556.  
  557. "TrendMicro-HouseCall": "TROJ_GEN.R060C0RH319"
  558.  
  559.  
  560. "Rising": "[email protected] (RDML:x+3NUBS/vCoQwqb/YbCY5w)"
  561.  
  562.  
  563. "SentinelOne": "DFI - Suspicious PE"
  564.  
  565.  
  566. "Fortinet": "W32/PossibleThreat"
  567.  
  568.  
  569. "AVG": "Win32:Malware-gen"
  570.  
  571.  
  572. "Cybereason": "malicious.125ee2"
  573.  
  574.  
  575. "Qihoo-360": "HEUR/QVM16.0.FC01.Malware.Gen"
  576.  
  577.  
  578.  
  579.  
  580. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  581. "Details":
  582.  
  583.  
  584. "Description": "Detects VirtualBox through the presence of a file",
  585. "Details":
  586.  
  587. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxControl.exe"
  588.  
  589.  
  590. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxTray.exe"
  591.  
  592.  
  593. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxDrvInst.exe"
  594.  
  595.  
  596. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxWHQLFake.exe"
  597.  
  598.  
  599. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxControl.exe"
  600.  
  601.  
  602. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxWHQLFake.exe"
  603.  
  604.  
  605. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\uninst.exe"
  606.  
  607.  
  608. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxDrvInst.exe"
  609.  
  610.  
  611. "file": "C:\\Program Files\\BLAOracle\\VirtualBox Guest Additions\\VBoxTray.exe"
  612.  
  613.  
  614.  
  615.  
  616. "Description": "Attempts to modify browser security settings",
  617. "Details":
  618.  
  619.  
  620. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  621. "Details":
  622.  
  623. "dropped": "clamav:Win.Trojan.Ascii_115_238_251_56-1, sha256:68ebc6f0578c6d962a404e1dfb0805880e11e0f89523fdca0cab6b1ed3df773d , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\lwssrmq.tmp, type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows"
  624.  
  625.  
  626. "dropped": "clamav:Win.Trojan.Ascii_115_238_251_56-1, sha256:c36ba8a06ddb6a5e1c5a1d159529c5883187786014bf5d279bc7bb08f563f4dd , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\lwssr.dll, type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows"
  627.  
  628.  
  629. "dropped": "clamav:Win.Trojan.Ascii_115_238_251_56-1, sha256:ae7285d73246bac8f18d94e562ed26120791b1c245768acefd4fe5518c819f20 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\ctfnon.exe*C:\\Windows\\eZdT\\ctfnon--.exe, type:PE32+ executable (GUI) x86-64, for MS Windows"
  630.  
  631.  
  632. "dropped": "clamav:Win.Malware.Zusy-6970403-0, sha256:68bfec6f32095d6dccc62db9e21cc2bca087826b8244bab8874edb51def72075 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\sm7pLn.tmp, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  633.  
  634.  
  635. "dropped": "clamav:Win.Trojan.Ascii_115_238_251_56-1, sha256:2ccdc090a239edd26d354de0e90bc9116b1c6813d9d074207400a4b0a9719733 , guest_paths:C:\\Windows\\zM2pL\\iqrkkp.yre, type:PE32+ executable (GUI) x86-64, for MS Windows"
  636.  
  637.  
  638. "dropped": "clamav:Win.Trojan.Ascii_115_238_251_56-1, sha256:b1f1ef424c39430654b6772df99a3d51b826aa8c4050b01b0d6de861e961f6e6 , guest_paths:C:\\Windows\\jxdxfg.uff, type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows"
  639.  
  640.  
  641. "dropped": "clamav:Win.Trojan.Ascii_115_238_251_56-1, sha256:83a22e6f7fd703e6949cd25a1635efb0bf4052fbcd77dcb7e042caa38dd50c09 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\svchstold.exe, type:PE32+ executable (GUI) x86-64, for MS Windows"
  642.  
  643.  
  644. "dropped": "clamav:Win.Malware.Zusy-6970403-0, sha256:29c34184df1da17ca212940bbb83228846da891c984d087ac80b3ed80b958c99 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\tqnomre.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  645.  
  646.  
  647. "dropped": "clamav:Win.Malware.Ulise-6840389-0, sha256:2e31018ad652af7293a71776986271024b59579da17125fdbf6c04b32c8db7d8 , guest_paths:C:\\Windows\\fc7bf6\\x9reg8Y.dll*C:\\Windows\\zM2pL\\vNwmNa.dat*C:\\Windows\\zM2pL\\p22Toc.dat*C:\\Windows\\zM2pL\\tzBoZQ.dat*C:\\Windows\\zM2pL\\eS3G7k.dat*C:\\Windows\\zM2pL\\v8q3pT.dat*C:\\Windows\\zM2pL\\cU049l.dat*C:\\Windows\\zM2pL\\myK0ig.dat*C:\\Windows\\zM2pL\\ol89iI.dat, type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows"
  648.  
  649.  
  650.  
  651.  
  652. "Description": "Attempts to disable browser security warnings",
  653. "Details":
  654.  
  655. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnonBadCertRecving"
  656.  
  657.  
  658.  
  659.  
  660. "Description": "Generates some ICMP traffic",
  661. "Details":
  662.  
  663.  
  664. "Description": "Created a service that was not started",
  665. "Details":
  666.  
  667. "service": "ZUrMDQv.sys"
  668.  
  669.  
  670.  
  671.  
  672. "Description": "Clears web history",
  673. "Details":
  674.  
  675. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  676.  
  677.  
  678. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  679.  
  680.  
  681. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  682.  
  683.  
  684. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  685.  
  686.  
  687. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  688.  
  689.  
  690. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  691.  
  692.  
  693. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  694.  
  695.  
  696. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  697.  
  698.  
  699. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  700.  
  701.  
  702. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  703.  
  704.  
  705. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  706.  
  707.  
  708. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  709.  
  710.  
  711. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  712.  
  713.  
  714. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  715.  
  716.  
  717. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  718.  
  719.  
  720. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  721.  
  722.  
  723.  
  724.  
  725.  
  726. * Started Service:
  727. "dnihfzt",
  728. "eojigaz"
  729.  
  730.  
  731. * Mutexes:
  732. "5d98dee5db9cc68f980d5e941513788c",
  733. "43f54da9766a357e7ddab86166b617d7",
  734. "WxproRunOnlyOnce",
  735. "cf6cb374ba556a9ff2b8821b5bfb8899",
  736. "2bd42fa02aa1452d9fa4565a0801ae33",
  737. "DBWinMutex",
  738. "4872cbb60592d64a70bc517bc960cd4d",
  739. "6b4886a4eb6c44895f9af6f6419ccd44",
  740. "80d736ff1f604ba084d252492211e834",
  741. "683B3320-5B64-0C1C-060E-716D93C02DB2617-E060-C1C0-46B5",
  742. "Global\\SCHide_2_ml",
  743. "Global\\SCHideMutex_2",
  744. "CloudsApp2017",
  745. "Global\\\\xe6\\x96\\xb9\\xe6\\xa0\\xbc\\xe5\\xad\\x90HideXXXX888\\xe5\\xae\\xa2\\xe6\\x88\\xb7\\xe7\\xab\\xaf!@#$%",
  746. "CicLoadWinStaWinSta0",
  747. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  748. "Local\\!IETld!Mutex",
  749. "Local\\ZonesCounterMutex",
  750. "Local\\ZoneAttributeCacheCounterMutex",
  751. "Local\\ZonesCacheCounterMutex",
  752. "Local\\ZonesLockedCacheCounterMutex",
  753. "ea813738960f01c9cab892dcf6c172e0",
  754. "Local\\_!MSFTHISTORY!_",
  755. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  756. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  757. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!"
  758.  
  759.  
  760. * Modified Files:
  761. "C:\\Windows\\System32\\lz_scby.txt",
  762. "C:\\Windows\\fc7bf6\\b42b0315d2707a870a55d67b9577336f",
  763. "C:\\Windows\\fc7bf6\\x9reg8Y.dll",
  764. "C:\\Windows\\fc7bf6\\lvQ99Up.exe",
  765. "C:\\Users\\user\\AppData\\Local\\jBkaB.dat",
  766. "C:\\p2pv221541.log",
  767. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\icafeads1.txt",
  768. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\rkhlI5GJmkQWabug1.txt",
  769. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\REOY6Fc6NFTBNN5c1.txt",
  770. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\cbba13d8c131.txt",
  771. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\48fd4b0a4521.txt",
  772. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\GYy5ztU9gaN26jEb1.txt",
  773. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\OPo6CIrcHoNu8M9m1.txt",
  774. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\oxQnEKn0NFR9NXeA1.txt",
  775. "C:\\Windows\\fc7bf6\\s66",
  776. "C:\\Windows\\hsmqzv.fcs",
  777. "C:\\Windows\\fc7bf6\\zbtg",
  778. "C:\\Windows\\fc7bf6\\schp",
  779. "C:\\Windows\\fc7bf6\\envreport",
  780. "C:\\Windows\\fc7bf6\\pbvfone",
  781. "C:\\Windows\\fc7bf6\\yunzbb",
  782. "C:\\Windows\\fc7bf6\\zglock",
  783. "C:\\Windows\\zM2pL\\vnftyi.dnr",
  784. "C:\\Windows\\rdgbsa.oab",
  785. "C:\\Windows\\jxdxfg.uff",
  786. "C:\\Windows\\zM2pL\\pvrrrf.xun",
  787. "C:\\Windows\\zM2pL\\qybrze.ybh",
  788. "C:\\Windows\\zM2pL\\iqrkkp.yre",
  789. "\\??\\KptProc",
  790. "C:\\Windows\\sysnative\\ZUrMDQv.sys",
  791. "C:\\Windows\\zM2pL\\vNwmNa.dat",
  792. "C:\\Windows\\zM2pL\\p22Toc.dat",
  793. "C:\\Windows\\zM2pL\\tzBoZQ.dat",
  794. "C:\\Windows\\zM2pL\\eS3G7k.dat",
  795. "C:\\Windows\\zM2pL\\v8q3pT.dat",
  796. "C:\\Windows\\zM2pL\\cU049l.dat",
  797. "C:\\Windows\\zM2pL\\myK0ig.dat",
  798. "C:\\Windows\\zM2pL\\ol89iI.dat",
  799. "C:\\Users\\user\\AppData\\Local\\sccon.ini",
  800. "C:\\Windows\\sysnative\\lvqpnhp.txt",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\nQAy.tmp",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\svchstold.exe",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\ctfnon.exe",
  804. "C:\\Windows\\eZdT\\ctfnon.exe",
  805. "\\??\\MsPort",
  806. "\\Device\\Afd\\AsyncConnectHlp",
  807. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ass1.txt",
  808. "C:\\Windows\\eZdT\\ctfnon--.exe",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\lwssr.dll",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\lwssrmq.tmp",
  811. "C:\\Windows\\run.bat",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk",
  813. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  815. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  816. "\\??\\PIPE\\srvsvc",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk",
  818. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\RdyFtmold.exe",
  819. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\RdyFtm.exe",
  820. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\QXXPEUold.exe",
  821. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\QXXPEU.exe",
  822. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\bVkquVold.exe",
  823. "\\??\\pipe\\getfuncaddrpipe",
  824. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\bVkquV.exe",
  825. "C:\\Users\\user\\AppData\\Roaming\\Tencent\\QQ\\nlni.tmp",
  826. "C:\\Users\\user\\AppData\\Roaming\\Tencent\\QQ\\wxgg.tmp",
  827. "C:\\Users\\user\\AppData\\Roaming\\Tencent\\QQ\\config.ini",
  828. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\sm7pLn.tmp",
  829. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\tqnomre.exe",
  830. "C:\\Windows\\sysnative\\GfIL.exe",
  831. "C:\\Windows\\sysnative\\zh-CN\\GfIL.exe.mui",
  832. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\unhk.tmp",
  833. "\\??\\EvnProtect",
  834. "C:\\Windows\\sysnative\\FwwTWkO.sys",
  835. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\unhk64.tmp",
  836. "\\??\\XadSafe",
  837. "C:\\Windows\\sysnative\\wypanms.sys",
  838. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\bbXNWp.xml",
  839. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  840. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\desktop.ini",
  841. "\\??\\WMIDataDevice",
  842. "\\??\\PIPE\\samr",
  843. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  844. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  845. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  846. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  847. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  848. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  849. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  850. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
  851.  
  852.  
  853. * Deleted Files:
  854. "C:\\Windows\\System32\\lz_scby.txt",
  855. "C:\\Windows\\fc7bf6\\lvQ99Up.exe",
  856. "C:\\Windows\\fc7bf6\\wq2bKVO.d",
  857. "C:\\Users\\user\\AppData\\Local\\jBkaB.dat",
  858. "C:\\Windows\\fc7bf6\\b42b0315d2707a870a55d67b9577336f",
  859. "C:\\Windows\\sysnative\\tmp5871219.dat",
  860. "C:\\Windows\\fc7bf6\\x9reg8Y.dll",
  861. "C:\\Windows\\hsmqzv.fcs",
  862. "C:\\Windows\\fc7bf6\\s66",
  863. "C:\\Windows\\fc7bf6\\zbtg",
  864. "C:\\Windows\\fc7bf6\\schp",
  865. "C:\\Windows\\fc7bf6\\envreport",
  866. "C:\\Windows\\fc7bf6\\pbvfone",
  867. "C:\\Windows\\fc7bf6\\yunzbb",
  868. "C:\\Windows\\fc7bf6\\zglock",
  869. "C:\\Windows\\zM2pL\\vnftyi.dnr",
  870. "C:\\Windows\\rdgbsa.oab",
  871. "C:\\Windows\\jxdxfg.uff",
  872. "C:\\Windows\\zM2pL\\pvrrrf.xun",
  873. "C:\\Windows\\zM2pL\\qybrze.ybh",
  874. "C:\\Windows\\zM2pL\\iqrkkp.yre",
  875. "C:\\Windows\\sysnative\\ZUrMDQv.sys",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\svchstold.exe",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\ctfnon.exe",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\nQAy.tmp",
  879. "C:\\Windows\\eZdT\\ctfnon.exe",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\lwssr.dll",
  881. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUGNux1.jpg",
  882. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUOpgu1.jpg",
  883. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBMngoJ1.jpg",
  884. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBiwNf1.png",
  885. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBSigw31.jpg",
  886. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\layout1",
  887. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUDFrs1.jpg",
  888. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBBFV0f1.png",
  889. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBCYr3U1.png",
  890. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BB2bztB1.png",
  891. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AAkgetg1.png",
  892. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\chrome1.htm",
  893. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\noConnect1",
  894. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAaeOki2.png",
  895. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUxPW21.jpg",
  896. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ass1.txt",
  897. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURh6A1.jpg",
  898. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBJ3XCJ1.png",
  899. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUOBJn1.jpg",
  900. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\RdyFtmold.exe",
  901. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBULJgM1.jpg",
  902. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUQzQr1.jpg",
  903. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\masthead_left1",
  904. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUgfJ21.jpg",
  905. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUGEWC1.jpg",
  906. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBz3ebk1.png",
  907. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\QXXPEUold.exe",
  908. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUMHuq1.jpg",
  909. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUQFzQ1.jpg",
  910. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\fallback.v2.min1.js",
  911. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\licensechange1",
  912. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AA36Tom1.png",
  913. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUJIfE1.jpg",
  914. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURuCL1.jpg",
  915. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\055643067C21678412144E247D39664A1.gif",
  916. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon3.ico",
  917. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\progress_bg_right1",
  918. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUE38v1.jpg",
  919. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\bVkquVold.exe",
  920. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAyx79e1.png",
  921. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUQtce1.jpg",
  922. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\google-play-download1.png",
  923. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUREuA1.jpg",
  924. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBPMoha1.png",
  925. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURaQ72.jpg",
  926. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUA5Vm1.png",
  927. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURGfg1.jpg",
  928. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURFFy1.jpg",
  929. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURGb41.png",
  930. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAywOab1.png",
  931. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUnN4f1.jpg",
  932. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUN5vs1.jpg",
  933. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\googlelogo_white_background_color_272x92dp1.png",
  934. "C:\\Users\\user\\AppData\\Roaming\\SAkkTV\\sm7pLn.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\masthead_fill1",
  936. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\burp1.htm",
  937. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBURn3B1.jpg",
  938. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\AA3l39h1.png",
  939. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\benefits-icon-shield1.jpg",
  940. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\app-store-download1.png",
  941. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\oxQnEKn0NFR9NXeA1.txt",
  942. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\Java3BillDevices_EN1",
  943. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUR9or1.jpg",
  944. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\chartbeat1.js",
  945. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUMJC01.jpg",
  946. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBtOBsY1.png",
  947. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AAAluHw1.jpg",
  948. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\config1.js",
  949. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURCTz1.jpg",
  950. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURHbv1.jpg",
  951. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\a0348fbc1.js",
  952. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\icon-fb1.jpg",
  953. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\icon-help1.jpg",
  954. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\5a-43cadc-8a01ca321.txt",
  955. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAywufo1.png",
  956. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBTBfNg1.png",
  957. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUeHe31.jpg",
  958. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progress_fg_left1",
  959. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate1",
  960. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUQ6UG1.jpg",
  961. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUPriM1.jpg",
  962. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUQSyB2.jpg",
  963. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\burp1.htm",
  964. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUP0Tp1.jpg",
  965. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBU3vgM1.jpg",
  966. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\5a-43cadc-8a01ca321.txt",
  967. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\URRYV-HX35J-LK4WZ-4TRKG-NBMKC1",
  968. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\devices1.png",
  969. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\progress_bg_left1",
  970. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBweSeT1.jpg",
  971. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAA8PBm1.png",
  972. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\AAvNCcs1.png",
  973. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBSzCzH1.png",
  974. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\f1.txt",
  975. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon1.ico",
  976. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUBICX1.jpg",
  977. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURs1F1.jpg",
  978. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUQUJ21.jpg",
  979. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\layout1",
  980. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progress_en1",
  981. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUwTzH1.jpg",
  982. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BB1lb5v1.png",
  983. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUOiYo1.jpg",
  984. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAzME7S1.png",
  985. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAyXiwM1.png",
  986. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURvqq1.jpg",
  987. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\CAONNZV6.log",
  988. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\views1",
  989. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\l10n1",
  990. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUOGdK1.jpg",
  991. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts1",
  992. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\complete_en1",
  993. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\common1",
  994. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURK2V1.jpg",
  995. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBTeGGL1.jpg",
  996. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBURPj91.jpg",
  997. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURuzZ1.jpg",
  998. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAA15Zd1.png",
  999. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBweSeT2.jpg",
  1000. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\gap2",
  1001. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURAO51.jpg",
  1002. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUDYUu1.png",
  1003. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBTVBUS1.jpg",
  1004. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\hero-back-mobile1.jpg",
  1005. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURw7P1.jpg",
  1006. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUNbnV2.jpg",
  1007. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\AApevLf1.png",
  1008. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\benefits-icon-world1.jpg",
  1009. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\host2",
  1010. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\REOY6Fc6NFTBNN5c1.txt",
  1011. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUPB3k1.jpg",
  1012. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURK4a1.jpg",
  1013. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURhqo1.jpg",
  1014. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\invalidcert1",
  1015. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\async_usersync1.htm",
  1016. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\48fd4b0a4521.txt",
  1017. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\fwlink1.htm",
  1018. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progress1",
  1019. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\complete1",
  1020. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\red_shield1",
  1021. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\burp1.htm",
  1022. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUPpCJ1.jpg",
  1023. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBSGe1V1.png",
  1024. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\nav_logo2291.png",
  1025. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\progress_fg_fill1",
  1026. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUQ28R2.jpg",
  1027. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURH531.jpg",
  1028. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUOO6P1.jpg",
  1029. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\google-logo-one-color1.jpg",
  1030. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBReDbo1.png",
  1031. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBjLpNF1.png",
  1032. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURCDB1.jpg",
  1033. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBgjtLu1.png",
  1034. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down1",
  1035. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBS7DY21.jpg",
  1036. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBih5H1.png",
  1037. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURMSL1.jpg",
  1038. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBULEUd1.jpg",
  1039. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUR6JC2.jpg",
  1040. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\autotrack1.js",
  1041. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\e151e51.gif",
  1042. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBbyo1E1.png",
  1043. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\OPo6CIrcHoNu8M9m1.txt",
  1044. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBTOvML1.png",
  1045. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURx4L1.jpg",
  1046. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\google_com1.htm",
  1047. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\chrome_throbber_fast1.gif",
  1048. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\common1",
  1049. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUB9jR1.jpg",
  1050. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\AAywGC01.png",
  1051. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\host1",
  1052. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUCKRK1.jpg",
  1053. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBSHLM31.jpg",
  1054. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\errorPageStrings2",
  1055. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUMvYi1.jpg",
  1056. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUQh9J1.jpg",
  1057. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\red_shield_481",
  1058. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\welcome_en1",
  1059. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUPEdB1.jpg",
  1060. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\AAexRGq1.png",
  1061. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURMlT1.jpg",
  1062. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\font1.css",
  1063. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\green_shield1",
  1064. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon2.ico",
  1065. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURG1Q1.jpg",
  1066. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\AAywHbG1.png",
  1067. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\AAfZ6og1.png",
  1068. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBTOD5k1.png",
  1069. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\dnserror1",
  1070. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\installer.min1.js",
  1071. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBTw0cA1.png",
  1072. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUMNVw1.jpg",
  1073. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\92-b7b846-86e270321",
  1074. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBTX9Tl1.jpg",
  1075. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\google-play-download1.jpg",
  1076. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\masthead_fill1",
  1077. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUQsBl1.jpg",
  1078. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUDzuP1.jpg",
  1079. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\chrome-logo1.svg",
  1080. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\google-logo1.jpg",
  1081. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\chrome-logo1.png",
  1082. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\font1.css",
  1083. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\icon-x1.jpg",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1094. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]",
  1100. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\841214~1",
  1101. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AA3LTD~1.PNG",
  1102. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AA6PEV~1.PNG",
  1103. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AA6Q14~1.JPG",
  1104. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAAAFJ~2.PNG",
  1105. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAAEOK~2.PNG",
  1106. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAGI0N~1.PNG",
  1107. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAKYOZ~1.PNG",
  1108. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AALQCA~1.JPG",
  1109. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAMRWG~1.PNG",
  1110. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AASVT3~1.PNG",
  1111. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAVCS6~1.PNG",
  1112. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAYXFD~1.PNG",
  1113. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\AAYXKR~1.PNG",
  1114. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BACKGR~1",
  1115. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BB5A8E~1.PNG",
  1116. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBAQ9_~1.PNG",
  1117. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBIENK~1.PNG",
  1118. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBINNL~1.PNG",
  1119. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBIUMZ~1.PNG",
  1120. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBMSG0~1.JPG",
  1121. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBMWEE~1.JPG",
  1122. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBQURO~1.JPG",
  1123. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBTAEE~1.JPG",
  1124. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBTEWQ~1.JPG",
  1125. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBTL7L~1.JPG",
  1126. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUBOT~2.JPG",
  1127. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUDFS~1.JPG",
  1128. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUDFV~1.JPG",
  1129. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUDSP~1.JPG",
  1130. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUE38~1.JPG",
  1131. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBULHN~1.JPG",
  1132. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUM34~1.JPG",
  1133. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUMGE~1.JPG",
  1134. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUMLE~1.JPG",
  1135. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUMU3~1.JPG",
  1136. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUMWT~1.JPG",
  1137. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUPBY~1.JPG",
  1138. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUPED~1.JPG",
  1139. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUPEN~1.JPG",
  1140. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUPTB~1.JPG",
  1141. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUQCC~1.JPG",
  1142. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUQCC~2.JPG",
  1143. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUQGJ~1.JPG",
  1144. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUQPV~1.JPG",
  1145. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUQTC~1.JPG",
  1146. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUQZQ~1.JPG",
  1147. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURCT~1.JPG",
  1148. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURFF~1.JPG",
  1149. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURGF~1.JPG",
  1150. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURW7~1.JPG",
  1151. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBURW8~1.JPG",
  1152. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUVIS~1.PNG",
  1153. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBUVPM~1.PNG",
  1154. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BBYCIY~1.PNG",
  1155. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BENEFI~1.JPG",
  1156. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BENEFI~2.JPG",
  1157. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\BURO_1~1.HTM",
  1158. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\CBBA13~1.TXT",
  1159. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\CHECK_~1",
  1160. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\CONFIG~1.JS",
  1161. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\CURSOR~1.BMP",
  1162. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\desktop.ini",
  1163. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\FALLBA~1.CSS",
  1164. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\FAVICO~1.ICO",
  1165. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\FAVICO~1.PNG",
  1166. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\FAVICO~2.PNG",
  1167. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\FONT_1~1.CSS",
  1168. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\FOOLGE~1.HTM",
  1169. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\INVALI~1",
  1170. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\INVALI~2",
  1171. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\JQUERY~1.JS",
  1172. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\L10N_1~1",
  1173. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\MAINV2~1.CSS",
  1174. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\MASTHE~1",
  1175. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\PROGRE~1",
  1176. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\PROGRE~2",
  1177. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\RS_ACT~1",
  1178. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\RTUTIL~1",
  1179. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\RUNTIM~1",
  1180. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\SAVE_P~1.PNG",
  1181. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\THANK-~1.PNG",
  1182. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\THANK-~1.HTM",
  1183. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\TOOLS_~1",
  1184. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\TRANSL~1.PNG",
  1185. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\URL_1_~1.HTM",
  1186. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\VIEWS_~1",
  1187. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\8BGZLQBV",
  1188. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\desktop.ini",
  1189. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\index.dat",
  1190. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\841214~1",
  1191. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AA3HAH~1.PNG",
  1192. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AA3LLD~1.PNG",
  1193. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AAGYMO~1.PNG",
  1194. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AAK0ZN~1.JPG",
  1195. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AAMOGY~1.PNG",
  1196. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AAXSPU~1.PNG",
  1197. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AAYHBK~1.JPG",
  1198. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\ADSWRA~1.JS",
  1199. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\APP-ST~1.JPG",
  1200. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AST_1_~1.JS",
  1201. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\AUWELC~1",
  1202. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BACKGR~1",
  1203. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBACPI~1.PNG",
  1204. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBLFV5~1.PNG",
  1205. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBNGKD~1.PNG",
  1206. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBRPDL~1.JPG",
  1207. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBU5I1~1.PNG",
  1208. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUBIC~1.JPG",
  1209. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUCVZ~1.JPG",
  1210. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUDRP~1.JPG",
  1211. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUFWL~1.JPG",
  1212. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUIDW~1.JPG",
  1213. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUJOM~1.JPG",
  1214. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBULOA~1.JPG",
  1215. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUMLN~1.JPG",
  1216. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUN0Y~1.JPG",
  1217. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUONW~1.JPG",
  1218. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUOQT~1.JPG",
  1219. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUPXI~1.JPG",
  1220. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUPXV~1.JPG",
  1221. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUQH9~1.JPG",
  1222. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUQSB~1.JPG",
  1223. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUQSY~1.JPG",
  1224. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBURCI~1.JPG",
  1225. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBURFF~1.JPG",
  1226. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBURJ4~1.JPG",
  1227. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBURMU~1.JPG",
  1228. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBURUZ~1.JPG",
  1229. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUTSB~1.JPG",
  1230. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUWVJ~1.JPG",
  1231. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BBUXGV~1.JPG",
  1232. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\BENEFI~1.JPG",
  1233. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\CHROME~1.PNG",
  1234. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\CONNEC~1.PNG",
  1235. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\DBAB-M~1.JPG",
  1236. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\desktop.ini",
  1237. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\DOWNLO~1.SVG",
  1238. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\FAVCEN~1",
  1239. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\FAVICO~1.ICO",
  1240. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\FAVICO~1.PNG",
  1241. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\FAVICO~2.ICO",
  1242. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\FAVICO~2.PNG",
  1243. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\FAVICO~3.ICO",
  1244. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\FWLINK~1.HTM",
  1245. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\F_1_~1.TXT",
  1246. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\GA_1_~1.JS",
  1247. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\GTM_1_~1.JS",
  1248. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\GYY5ZT~1.TXT",
  1249. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\ICON-T~1.JPG",
  1250. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\LICENS~1",
  1251. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\MODERN~1.JS",
  1252. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\RKHLI5~1.TXT",
  1253. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\RS_ACT~1",
  1254. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\RTUTIL~1",
  1255. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\RUNTIM~1",
  1256. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\SEARCH~1.HTM",
  1257. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8\\WELCOM~1",
  1258. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\PA320MG8",
  1259. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\92-B7B~1",
  1260. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AA3EOZ~1.PNG",
  1261. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AA565D~1.PNG",
  1262. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AA6OGH~1.PNG",
  1263. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAGNIP~1.PNG",
  1264. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AAQSFD~1.PNG",
  1265. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\AUWELC~1",
  1266. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBCLEE~2.PNG",
  1267. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBTOVM~1.PNG",
  1268. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUB9J~1.JPG",
  1269. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUCKR~1.JPG",
  1270. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUDEO~1.JPG",
  1271. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUE92~1.PNG",
  1272. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUPQB~1.JPG",
  1273. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUQH9~1.JPG",
  1274. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUQJ6~1.JPG",
  1275. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBUR6J~1.JPG",
  1276. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURBJ~1.JPG",
  1277. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURFV~1.JPG",
  1278. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BBURX4~1.JPG",
  1279. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\BURP_2~1.HTM",
  1280. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\CD9366~1.EOT",
  1281. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\CHROME~1.GIF",
  1282. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\COMMON~1",
  1283. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\desktop.ini",
  1284. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\ERRORP~2",
  1285. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\FAVICO~1.PNG",
  1286. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\FAVICO~2.PNG",
  1287. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\FAVICO~3.PNG",
  1288. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\FAVICO~4.PNG",
  1289. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\FONT_1~1.CSS",
  1290. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\GOOGLE~1.APP",
  1291. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\ICON-Y~1.JPG",
  1292. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\MASTHE~1",
  1293. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\Q8H2MS75",
  1294. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\841214~1",
  1295. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\92-B7B~2",
  1296. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUDZU~1.JPG",
  1297. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBUQSB~1.JPG",
  1298. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\BBURGK~1.JPG",
  1299. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\CHROME~1.PNG",
  1300. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\CHROME~1.SVG",
  1301. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\desktop.ini",
  1302. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\FONT_1~1.CSS",
  1303. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\F_1_~1.TXT",
  1304. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\GOOGLE~1.JPG",
  1305. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ICAFEA~1.TXT",
  1306. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ICON-X~1.JPG",
  1307. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\S4VH3RFR",
  1308. "C:\\Users\\user\\Local Settings\\Temporary Internet Files\\Content.IE5",
  1309. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  1310. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5",
  1311. "C:\\Users\\user\\Application Data\\360se\\ie8data\\Temporary Internet Files\\Content.IE5",
  1312. "C:\\Users\\user\\Local Settings\\Application Data\\360Chrome\\Chrome\\User Data\\Default\\CacheIE\\Content.IE5",
  1313. "C:\\Users\\user\\Local Settings\\Application Data\\liebao\\User Data\\iecache\\Content.IE5",
  1314. "C:\\Windows\\run.bat"
  1315.  
  1316.  
  1317. * Modified Registry Keys:
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bmp\\OpenWithProgids\\Paint.Picture",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cab\\OpenWithProgids\\CABFolder",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.contact\\OpenWithProgids\\contact_wab_auto_file",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.css\\OpenWithProgids\\CSSfile",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.csv\\OpenWithProgids\\Excel.CSV",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dib\\OpenWithProgids\\Paint.Picture",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dll\\OpenWithProgids\\dllfile",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\OpenWithProgids\\Word.Document.8",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docm\\OpenWithProgids\\Word.DocumentMacroEnabled.12",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\OpenWithProgids\\Word.Document.12",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dot\\OpenWithProgids\\Word.Template.8",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dotm\\OpenWithProgids\\Word.TemplateMacroEnabled.12",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dotx\\OpenWithProgids\\Word.Template.12",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dwfx\\OpenWithProgids\\Windows.XPSReachViewer",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.easmx\\OpenWithProgids\\Windows.XPSReachViewer",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.edrwx\\OpenWithProgids\\Windows.XPSReachViewer",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.emf\\OpenWithProgids\\emffile",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.eprtx\\OpenWithProgids\\Windows.XPSReachViewer",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exe\\OpenWithProgids\\exefile",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.fon\\OpenWithProgids\\fonfile",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gif\\OpenWithProgids\\giffile",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\OpenWithProgids\\ChromeHTML",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\OpenWithProgids\\ChromeHTML",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ico\\OpenWithProgids\\icofile",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ini\\OpenWithProgids\\inifile",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jfif\\OpenWithProgids\\pjpegfile",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpe\\OpenWithProgids\\jpegfile",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpeg\\OpenWithProgids\\jpegfile",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpg\\OpenWithProgids\\jpegfile",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jtx\\OpenWithProgids\\Windows.XPSReachViewer",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.lnk\\OpenWithProgids\\lnkfile",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mht\\OpenWithProgids\\mhtmlfile",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mhtml\\OpenWithProgids\\mhtmlfile",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.msg\\OpenWithProgids\\Outlook.File.msg.15",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\S38OS404-1Q43-42S2-9305-67QR0O28SP23\\rkcybere.rkr",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ocx\\OpenWithProgids\\ocxfile",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.odt\\OpenWithProgids\\Word.OpenDocumentText.12",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.otf\\OpenWithProgids\\otffile",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.png\\OpenWithProgids\\pngfile",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pot\\OpenWithProgids\\PowerPoint.Template.8",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.potm\\OpenWithProgids\\PowerPoint.TemplateMacroEnabled.12",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.potx\\OpenWithProgids\\PowerPoint.Template.12",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppam\\OpenWithProgids\\PowerPoint.Addin.12",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppsm\\OpenWithProgids\\PowerPoint.SlideShowMacroEnabled.12",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppsx\\OpenWithProgids\\PowerPoint.SlideShow.12",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppt\\OpenWithProgids\\PowerPoint.Show.8",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pptm\\OpenWithProgids\\PowerPoint.ShowMacroEnabled.12",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pptx\\OpenWithProgids\\PowerPoint.Show.12",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ps1xml\\OpenWithProgids\\Microsoft.PowerShellXMLData.1",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rle\\OpenWithProgids\\rlefile",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rtf\\OpenWithProgids\\Word.RTF.8",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.scf\\OpenWithProgids\\SHCmdFile",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.search-ms\\OpenWithProgids\\SearchFolder",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shtml\\OpenWithProgids\\ChromeHTML",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sldm\\OpenWithProgids\\PowerPoint.SlideMacroEnabled.12",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sldx\\OpenWithProgids\\PowerPoint.Slide.12",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sys\\OpenWithProgids\\sysfile",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tif\\OpenWithProgids\\TIFImage.Document",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tiff\\OpenWithProgids\\TIFImage.Document",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttc\\OpenWithProgids\\ttcfile",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttf\\OpenWithProgids\\ttffile",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\OpenWithProgids\\txtfile",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vsto\\OpenWithProgids\\bootstrap.vsto.1",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wdp\\OpenWithProgids\\wdpfile",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmf\\OpenWithProgids\\wmffile",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlam\\OpenWithProgids\\Excel.AddInMacroEnabled",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xls\\OpenWithProgids\\Excel.Sheet.8",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsb\\OpenWithProgids\\Excel.SheetBinaryMacroEnabled.12",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsm\\OpenWithProgids\\Excel.SheetMacroEnabled.12",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsx\\OpenWithProgids\\Excel.Sheet.12",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlt\\OpenWithProgids\\Excel.Template.8",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xltm\\OpenWithProgids\\Excel.TemplateMacroEnabled",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xltx\\OpenWithProgids\\Excel.Template",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xml\\OpenWithProgids\\xmlfile",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xps\\OpenWithProgids\\Windows.XPSReachViewer",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xsl\\OpenWithProgids\\xslfile",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.zip\\OpenWithProgids\\CompressedFolder",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
  1397. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.106\\CheckSetting",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.103\\CheckSetting",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.100\\CheckSetting",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.102\\CheckSetting",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.104\\CheckSetting",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.101\\CheckSetting",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1407. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_BROWSER_EMULATION\\icacls.exe",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\State",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertificateRevocation",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnonBadCertRecving",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\\1609",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2\\1609",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\1609",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\\1609",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI",
  1416. "HKEY_LOCAL_MACHINE\\SOFTWARE\\123\\201985",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
  1418. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
  1419. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1420. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\eojigaz",
  1421. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\eojigaz\\Type",
  1422. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\eojigaz\\Start",
  1423. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\eojigaz\\ErrorControl",
  1424. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\eojigaz\\ImagePath",
  1425. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\eojigaz\\DisplayName",
  1426. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_BROWSER_EMULATION\\convert.exe",
  1427. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  1428. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  1429. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  1430. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1431. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  1432. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  1433. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  1434. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  1435. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  1436. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  1437. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  1438.  
  1439.  
  1440. * Deleted Registry Keys:
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1442. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1444. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  1445.  
  1446.  
  1447. * DNS Communications:
  1448.  
  1449. "type": "A",
  1450. "request": "www.baidu.com",
  1451. "answers":
  1452.  
  1453. "data": "www.a.shifen.com",
  1454. "type": "CNAME"
  1455.  
  1456.  
  1457. "data": "103.235.46.39",
  1458. "type": "A"
  1459.  
  1460.  
  1461. "data": "www.wshifen.com",
  1462. "type": "CNAME"
  1463.  
  1464.  
  1465.  
  1466.  
  1467. "type": "A",
  1468. "request": "np2p.soomeng.com",
  1469. "answers":
  1470.  
  1471. "data": "125.211.204.241",
  1472. "type": "A"
  1473.  
  1474.  
  1475. "data": "1.31.173.91",
  1476. "type": "A"
  1477.  
  1478.  
  1479. "data": "np2p.soomeng.com.cdn.dnsv1.com",
  1480. "type": "CNAME"
  1481.  
  1482.  
  1483. "data": "220.194.79.107",
  1484. "type": "A"
  1485.  
  1486.  
  1487. "data": "562573.p23.tc.cdntip.com",
  1488. "type": "CNAME"
  1489.  
  1490.  
  1491. "data": "118.212.225.117",
  1492. "type": "A"
  1493.  
  1494.  
  1495. "data": "1.189.213.92",
  1496. "type": "A"
  1497.  
  1498.  
  1499. "data": "220.194.79.73",
  1500. "type": "A"
  1501.  
  1502.  
  1503. "data": "218.11.11.246",
  1504. "type": "A"
  1505.  
  1506.  
  1507. "data": "218.11.11.245",
  1508. "type": "A"
  1509.  
  1510.  
  1511. "data": "110.53.246.91",
  1512. "type": "A"
  1513.  
  1514.  
  1515. "data": "218.11.8.104",
  1516. "type": "A"
  1517.  
  1518.  
  1519. "data": "220.194.223.71",
  1520. "type": "A"
  1521.  
  1522.  
  1523. "data": "220.194.223.87",
  1524. "type": "A"
  1525.  
  1526.  
  1527. "data": "221.204.166.36",
  1528. "type": "A"
  1529.  
  1530.  
  1531. "data": "211.91.160.204",
  1532. "type": "A"
  1533.  
  1534.  
  1535. "data": "221.204.166.20",
  1536. "type": "A"
  1537.  
  1538.  
  1539.  
  1540.  
  1541. "type": "A",
  1542. "request": "np2p.inibin.com",
  1543. "answers":
  1544.  
  1545. "data": "125.211.204.241",
  1546. "type": "A"
  1547.  
  1548.  
  1549. "data": "1.31.173.91",
  1550. "type": "A"
  1551.  
  1552.  
  1553. "data": "220.194.79.107",
  1554. "type": "A"
  1555.  
  1556.  
  1557. "data": "562574.p23.tc.cdntip.com",
  1558. "type": "CNAME"
  1559.  
  1560.  
  1561. "data": "118.212.225.117",
  1562. "type": "A"
  1563.  
  1564.  
  1565. "data": "1.189.213.92",
  1566. "type": "A"
  1567.  
  1568.  
  1569. "data": "220.194.79.73",
  1570. "type": "A"
  1571.  
  1572.  
  1573. "data": "218.11.11.246",
  1574. "type": "A"
  1575.  
  1576.  
  1577. "data": "218.11.11.245",
  1578. "type": "A"
  1579.  
  1580.  
  1581. "data": "110.53.246.91",
  1582. "type": "A"
  1583.  
  1584.  
  1585. "data": "np2p.inibin.com.cdn.dnsv1.com",
  1586. "type": "CNAME"
  1587.  
  1588.  
  1589. "data": "218.11.8.104",
  1590. "type": "A"
  1591.  
  1592.  
  1593. "data": "220.194.223.71",
  1594. "type": "A"
  1595.  
  1596.  
  1597. "data": "220.194.223.87",
  1598. "type": "A"
  1599.  
  1600.  
  1601. "data": "221.204.166.36",
  1602. "type": "A"
  1603.  
  1604.  
  1605. "data": "211.91.160.204",
  1606. "type": "A"
  1607.  
  1608.  
  1609. "data": "221.204.166.20",
  1610. "type": "A"
  1611.  
  1612.  
  1613.  
  1614.  
  1615. "type": "A",
  1616. "request": "next.91xiaba.com",
  1617. "answers":
  1618.  
  1619. "data": "157.185.169.223",
  1620. "type": "A"
  1621.  
  1622.  
  1623. "data": "next.91xiaba.com.wsdvs.com",
  1624. "type": "CNAME"
  1625.  
  1626.  
  1627.  
  1628.  
  1629. "type": "A",
  1630. "request": "log.uinfo.soomeng.com",
  1631. "answers":
  1632.  
  1633. "data": "125.211.204.241",
  1634. "type": "A"
  1635.  
  1636.  
  1637. "data": "1.31.173.91",
  1638. "type": "A"
  1639.  
  1640.  
  1641. "data": "551347.p23.tc.cdntip.com",
  1642. "type": "CNAME"
  1643.  
  1644.  
  1645. "data": "220.194.79.107",
  1646. "type": "A"
  1647.  
  1648.  
  1649. "data": "118.212.225.117",
  1650. "type": "A"
  1651.  
  1652.  
  1653. "data": "1.189.213.92",
  1654. "type": "A"
  1655.  
  1656.  
  1657. "data": "220.194.79.73",
  1658. "type": "A"
  1659.  
  1660.  
  1661. "data": "218.11.11.246",
  1662. "type": "A"
  1663.  
  1664.  
  1665. "data": "218.11.11.245",
  1666. "type": "A"
  1667.  
  1668.  
  1669. "data": "log.uinfo.soomeng.com.cdn.dnsv1.com",
  1670. "type": "CNAME"
  1671.  
  1672.  
  1673. "data": "110.53.246.91",
  1674. "type": "A"
  1675.  
  1676.  
  1677. "data": "218.11.8.104",
  1678. "type": "A"
  1679.  
  1680.  
  1681. "data": "220.194.223.71",
  1682. "type": "A"
  1683.  
  1684.  
  1685. "data": "220.194.223.87",
  1686. "type": "A"
  1687.  
  1688.  
  1689. "data": "221.204.166.36",
  1690. "type": "A"
  1691.  
  1692.  
  1693. "data": "211.91.160.204",
  1694. "type": "A"
  1695.  
  1696.  
  1697. "data": "221.204.166.20",
  1698. "type": "A"
  1699.  
  1700.  
  1701.  
  1702.  
  1703. "type": "A",
  1704. "request": "ln.adsxz.com",
  1705. "answers":
  1706.  
  1707. "data": "157.185.169.223",
  1708. "type": "A"
  1709.  
  1710.  
  1711. "data": "ln.adsxz.com.wsdvs.com",
  1712. "type": "CNAME"
  1713.  
  1714.  
  1715.  
  1716.  
  1717. "type": "A",
  1718. "request": "pro.icafe66.com",
  1719. "answers":
  1720.  
  1721. "data": "125.211.204.241",
  1722. "type": "A"
  1723.  
  1724.  
  1725. "data": "1.31.173.91",
  1726. "type": "A"
  1727.  
  1728.  
  1729. "data": "220.194.79.107",
  1730. "type": "A"
  1731.  
  1732.  
  1733. "data": "118.212.225.117",
  1734. "type": "A"
  1735.  
  1736.  
  1737. "data": "1.189.213.92",
  1738. "type": "A"
  1739.  
  1740.  
  1741. "data": "220.194.79.73",
  1742. "type": "A"
  1743.  
  1744.  
  1745. "data": "218.11.11.246",
  1746. "type": "A"
  1747.  
  1748.  
  1749. "data": "218.11.11.245",
  1750. "type": "A"
  1751.  
  1752.  
  1753. "data": "588352.p23.tc.cdntip.com",
  1754. "type": "CNAME"
  1755.  
  1756.  
  1757. "data": "110.53.246.91",
  1758. "type": "A"
  1759.  
  1760.  
  1761. "data": "218.11.8.104",
  1762. "type": "A"
  1763.  
  1764.  
  1765. "data": "220.194.223.71",
  1766. "type": "A"
  1767.  
  1768.  
  1769. "data": "220.194.223.87",
  1770. "type": "A"
  1771.  
  1772.  
  1773. "data": "221.204.166.36",
  1774. "type": "A"
  1775.  
  1776.  
  1777. "data": "pro.icafe66.com.cdn.dnsv1.com",
  1778. "type": "CNAME"
  1779.  
  1780.  
  1781. "data": "211.91.160.204",
  1782. "type": "A"
  1783.  
  1784.  
  1785. "data": "221.204.166.20",
  1786. "type": "A"
  1787.  
  1788.  
  1789.  
  1790.  
  1791. "type": "A",
  1792. "request": "log.soomeng.com",
  1793. "answers":
  1794.  
  1795. "data": "123.206.222.176",
  1796. "type": "A"
  1797.  
  1798.  
  1799.  
  1800.  
  1801.  
  1802. * Domains:
  1803.  
  1804. "ip": "103.235.46.39",
  1805. "domain": "www.baidu.com"
  1806.  
  1807.  
  1808. "ip": "110.53.246.91",
  1809. "domain": "np2p.soomeng.com"
  1810.  
  1811.  
  1812. "ip": "157.185.169.223",
  1813. "domain": "ln.adsxz.com"
  1814.  
  1815.  
  1816. "ip": "157.185.169.223",
  1817. "domain": "next.91xiaba.com"
  1818.  
  1819.  
  1820. "ip": "123.206.222.176",
  1821. "domain": "log.soomeng.com"
  1822.  
  1823.  
  1824. "ip": "110.53.246.91",
  1825. "domain": "np2p.inibin.com"
  1826.  
  1827.  
  1828. "ip": "218.11.11.245",
  1829. "domain": "pro.icafe66.com"
  1830.  
  1831.  
  1832. "ip": "220.194.79.107",
  1833. "domain": "log.uinfo.soomeng.com"
  1834.  
  1835.  
  1836.  
  1837. * Network Communication - ICMP:
  1838.  
  1839. "src": "169.254.255.254
  1840. "dst": "103.235.46.39",
  1841. "type": 8,
  1842. "data": "\\x9b~r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
  1843.  
  1844.  
  1845. "src": "103.235.46.39",
  1846. "dst": "169.254.255.254
  1847. "type": 0,
  1848. "data": "\\x9b~r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
  1849.  
  1850.  
  1851.  
  1852. * Network Communication - HTTP:
  1853.  
  1854. "count": 1,
  1855. "body": "",
  1856. "uri": "http://np2p.inibin.com/icafeads/?usr=209575348.0&mac=18c086cd4732&ver=2,2,2,4131&winos=64",
  1857. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1858. "method": "GET",
  1859. "host": "np2p.inibin.com",
  1860. "version": "1.1",
  1861. "path": "/icafeads/?usr=209575348.0&mac=18c086cd4732&ver=2,2,2,4131&winos=64",
  1862. "data": "GET /icafeads/?usr=209575348.0&mac=18c086cd4732&ver=2,2,2,4131&winos=64 HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: np2p.inibin.com\r\nConnection: Keep-Alive\r\n\r\n",
  1863. "port": 80
  1864.  
  1865.  
  1866. "count": 1,
  1867. "body": "",
  1868. "uri": "http://next.91xiaba.com/plat/rkhlI5GJmkQWabug",
  1869. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1870. "method": "GET",
  1871. "host": "next.91xiaba.com",
  1872. "version": "1.1",
  1873. "path": "/plat/rkhlI5GJmkQWabug",
  1874. "data": "GET /plat/rkhlI5GJmkQWabug HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: next.91xiaba.com\r\nConnection: Keep-Alive\r\n\r\n",
  1875. "port": 80
  1876.  
  1877.  
  1878. "count": 1,
  1879. "body": "",
  1880. "uri": "http://next.91xiaba.com/plat/REOY6Fc6NFTBNN5c",
  1881. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1882. "method": "GET",
  1883. "host": "next.91xiaba.com",
  1884. "version": "1.1",
  1885. "path": "/plat/REOY6Fc6NFTBNN5c",
  1886. "data": "GET /plat/REOY6Fc6NFTBNN5c HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: next.91xiaba.com\r\nConnection: Keep-Alive\r\n\r\n",
  1887. "port": 80
  1888.  
  1889.  
  1890. "count": 1,
  1891. "body": "",
  1892. "uri": "http://next.91xiaba.com/plat/cbba13d8c13",
  1893. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1894. "method": "GET",
  1895. "host": "next.91xiaba.com",
  1896. "version": "1.1",
  1897. "path": "/plat/cbba13d8c13",
  1898. "data": "GET /plat/cbba13d8c13 HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: next.91xiaba.com\r\nConnection: Keep-Alive\r\n\r\n",
  1899. "port": 80
  1900.  
  1901.  
  1902. "count": 1,
  1903. "body": "",
  1904. "uri": "http://next.91xiaba.com/plat/48fd4b0a452",
  1905. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1906. "method": "GET",
  1907. "host": "next.91xiaba.com",
  1908. "version": "1.1",
  1909. "path": "/plat/48fd4b0a452",
  1910. "data": "GET /plat/48fd4b0a452 HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: next.91xiaba.com\r\nConnection: Keep-Alive\r\n\r\n",
  1911. "port": 80
  1912.  
  1913.  
  1914. "count": 1,
  1915. "body": "",
  1916. "uri": "http://next.91xiaba.com/plat/GYy5ztU9gaN26jEb",
  1917. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1918. "method": "GET",
  1919. "host": "next.91xiaba.com",
  1920. "version": "1.1",
  1921. "path": "/plat/GYy5ztU9gaN26jEb",
  1922. "data": "GET /plat/GYy5ztU9gaN26jEb HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: next.91xiaba.com\r\nConnection: Keep-Alive\r\n\r\n",
  1923. "port": 80
  1924.  
  1925.  
  1926. "count": 1,
  1927. "body": "",
  1928. "uri": "http://next.91xiaba.com/plat/OPo6CIrcHoNu8M9m",
  1929. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1930. "method": "GET",
  1931. "host": "next.91xiaba.com",
  1932. "version": "1.1",
  1933. "path": "/plat/OPo6CIrcHoNu8M9m",
  1934. "data": "GET /plat/OPo6CIrcHoNu8M9m HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: next.91xiaba.com\r\nConnection: Keep-Alive\r\n\r\n",
  1935. "port": 80
  1936.  
  1937.  
  1938. "count": 1,
  1939. "body": "",
  1940. "uri": "http://next.91xiaba.com/plat/oxQnEKn0NFR9NXeA",
  1941. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1942. "method": "GET",
  1943. "host": "next.91xiaba.com",
  1944. "version": "1.1",
  1945. "path": "/plat/oxQnEKn0NFR9NXeA",
  1946. "data": "GET /plat/oxQnEKn0NFR9NXeA HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: next.91xiaba.com\r\nConnection: Keep-Alive\r\n\r\n",
  1947. "port": 80
  1948.  
  1949.  
  1950. "count": 4,
  1951. "body": "",
  1952. "uri": "http://ln.adsxz.com/cool/Urls.ini",
  1953. "user-agent": "WinHTTP/1.0 (Windows NT 6.1)",
  1954. "method": "GET",
  1955. "host": "ln.adsxz.com",
  1956. "version": "1.1",
  1957. "path": "/cool/Urls.ini",
  1958. "data": "GET /cool/Urls.ini HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: WinHTTP/1.0 (Windows NT 6.1)\r\nHost: ln.adsxz.com\r\n\r\n",
  1959. "port": 80
  1960.  
  1961.  
  1962. "count": 3,
  1963. "body": "",
  1964. "uri": "http://ln.adsxz.com/cool/pt/Jason.ini",
  1965. "user-agent": "WinHTTP/1.0 (Windows NT 6.1)",
  1966. "method": "GET",
  1967. "host": "ln.adsxz.com",
  1968. "version": "1.1",
  1969. "path": "/cool/pt/Jason.ini",
  1970. "data": "GET /cool/pt/Jason.ini HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: WinHTTP/1.0 (Windows NT 6.1)\r\nHost: ln.adsxz.com\r\n\r\n",
  1971. "port": 80
  1972.  
  1973.  
  1974. "count": 3,
  1975. "body": "",
  1976. "uri": "http://pro.icafe66.com/as/ass.txt",
  1977. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1978. "method": "GET",
  1979. "host": "pro.icafe66.com",
  1980. "version": "1.1",
  1981. "path": "/as/ass.txt",
  1982. "data": "GET /as/ass.txt HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: pro.icafe66.com\r\nConnection: Keep-Alive\r\n\r\n",
  1983. "port": 80
  1984.  
  1985.  
  1986. "count": 2,
  1987. "body": "",
  1988. "uri": "http://pro.icafe66.com/yunzb/qd0/jm.json",
  1989. "user-agent": "WinHTTP/1.0 (Windows NT 6.1)",
  1990. "method": "GET",
  1991. "host": "pro.icafe66.com",
  1992. "version": "1.1",
  1993. "path": "/yunzb/qd0/jm.json",
  1994. "data": "GET /yunzb/qd0/jm.json HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: WinHTTP/1.0 (Windows NT 6.1)\r\nHost: pro.icafe66.com\r\n\r\n",
  1995. "port": 80
  1996.  
  1997.  
  1998. "count": 2,
  1999. "body": "",
  2000. "uri": "http://log.soomeng.com/yzb/?mac=18c086cd4732&uid=209575348.0&plat=icafeads&tm=1",
  2001. "user-agent": "WinHTTP/1.0 (Windows NT 6.1)",
  2002. "method": "GET",
  2003. "host": "log.soomeng.com",
  2004. "version": "1.1",
  2005. "path": "/yzb/?mac=18c086cd4732&uid=209575348.0&plat=icafeads&tm=1",
  2006. "data": "GET /yzb/?mac=18c086cd4732&uid=209575348.0&plat=icafeads&tm=1 HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: WinHTTP/1.0 (Windows NT 6.1)\r\nHost: log.soomeng.com\r\n\r\n",
  2007. "port": 80
  2008.  
  2009.  
  2010. "count": 2,
  2011. "body": "",
  2012. "uri": "http://log.uinfo.soomeng.com/mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIwRURBMjNFMm4xOEMwODZDRDQ3MzJ8Mnww",
  2013. "user-agent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.2595.400 QQBrowser/9.6.10872.400",
  2014. "method": "GET",
  2015. "host": "log.uinfo.soomeng.com",
  2016. "version": "1.1",
  2017. "path": "/mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIwRURBMjNFMm4xOEMwODZDRDQ3MzJ8Mnww",
  2018. "data": "GET /mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIwRURBMjNFMm4xOEMwODZDRDQ3MzJ8Mnww HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: deflate\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.2595.400 QQBrowser/9.6.10872.400\r\nHost: log.uinfo.soomeng.com\r\nConnection: Close\r\nCache-Control: no-cache\r\n\r\n",
  2019. "port": 80
  2020.  
  2021.  
  2022. "count": 1,
  2023. "body": "",
  2024. "uri": "http://ln.adsxz.com/cool/pt/Jason1.ini",
  2025. "user-agent": "WinHTTP/1.0 (Windows NT 6.1)",
  2026. "method": "GET",
  2027. "host": "ln.adsxz.com",
  2028. "version": "1.1",
  2029. "path": "/cool/pt/Jason1.ini",
  2030. "data": "GET /cool/pt/Jason1.ini HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: WinHTTP/1.0 (Windows NT 6.1)\r\nHost: ln.adsxz.com\r\n\r\n",
  2031. "port": 80
  2032.  
  2033.  
  2034. "count": 4,
  2035. "body": "",
  2036. "uri": "http://log.uinfo.soomeng.com/mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIxMTQyRjA0Nm4xOEMwODZDRDQ3MzJ8Mnww",
  2037. "user-agent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.2595.400 QQBrowser/9.6.10872.400",
  2038. "method": "GET",
  2039. "host": "log.uinfo.soomeng.com",
  2040. "version": "1.1",
  2041. "path": "/mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIxMTQyRjA0Nm4xOEMwODZDRDQ3MzJ8Mnww",
  2042. "data": "GET /mac.php?MThDMDg2Q0Q0NzMyfDIwOTU3NTM0OC4wfGljYWZlYWRzfDFENTRCNkIxMTQyRjA0Nm4xOEMwODZDRDQ3MzJ8Mnww HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: deflate\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.2595.400 QQBrowser/9.6.10872.400\r\nHost: log.uinfo.soomeng.com\r\nConnection: Close\r\nCache-Control: no-cache\r\n\r\n",
  2043. "port": 80
  2044.  
  2045.  
  2046. "count": 1,
  2047. "body": "",
  2048. "uri": "http://log.soomeng.com/home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=1",
  2049. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)",
  2050. "method": "GET",
  2051. "host": "log.soomeng.com",
  2052. "version": "1.1",
  2053. "path": "/home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=1",
  2054. "data": "GET /home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=1 HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: deflate\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)\r\nHost: log.soomeng.com\r\nConnection: Close\r\nCache-Control: no-cache\r\n\r\n",
  2055. "port": 80
  2056.  
  2057.  
  2058. "count": 1,
  2059. "body": "",
  2060. "uri": "http://log.soomeng.com/home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=2",
  2061. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)",
  2062. "method": "GET",
  2063. "host": "log.soomeng.com",
  2064. "version": "1.1",
  2065. "path": "/home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=2",
  2066. "data": "GET /home/?user=209575348.0&plat=icafeads&mac=18:C0:86:CD:47:32&hmid=90162-01791&tm=2 HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: deflate\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)\r\nHost: log.soomeng.com\r\nConnection: Close\r\nCache-Control: no-cache\r\n\r\n",
  2067. "port": 80
  2068.  
  2069.  
  2070.  
  2071. * Network Communication - SMTP:
  2072.  
  2073. * Network Communication - Hosts:
  2074.  
  2075. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!