Exes_f7d2f6962f1f054d66f42ff1a8bb2980_exe_2019-07-23_08_30.txt

* MalFamily: ""

* MalScore: 2.5

* File Name: "Exes_f7d2f6962f1f054d66f42ff1a8bb2980.exe"
* File Size: 1105920
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "1ea5809664de23e103d5fdc2cbbcd4759e5e059e71efaf534734e93ef4e0198c"
* MD5: "f7d2f6962f1f054d66f42ff1a8bb2980"
* SHA1: "478d22dd07e7bcc6c8be8395bdaffdfd6411a42c"
* SHA512: "5b7ff38ddddc904c282989146da3ffdc4b7724787b4b01266528e09d6251d08807cd76149e7f8caa34bba426b09f4cfd0faba81703a405ff50764b472790fdff"
* CRC32: "6829DFC9"
* SSDEEP: "12288:pyF8VcJD0uU5093sICdD9mrwr1w0hY3zaOl12piUrSnNy5L7fJ0RqjPYLtO:MF8k0t0uIsmrwJYz5kJ02c"

* Process Execution:
    "Exes_f7d2f6962f1f054d66f42ff1a8bb2980.exe"


* Executed Commands:
    "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_f7d2f6962f1f054d66f42ff1a8bb2980.exe\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details":

                "Spam": "Exes_f7d2f6962f1f054d66f42ff1a8bb2980.exe (2200) called API CreateProcessInternalW 38223 times"





* Started Service:

* Mutexes:

* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB3B40A2F572AC1B5.TMP"


* Deleted Files:

* Modified Registry Keys:
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\b7dnUWWQOvCTKPxFYFM4HWNIQvol13LmPlYFmEy186\\ra0DHqp182",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\b7dnUWWQOvCTKPxFYFM4HWNIQvol13LmPlYFmEy186\\ra0DHqp182\\fgAJqE4ENpniqZqVsx9187",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\F4CryDCCEIyDu159\\ncSFhaiEMyDkUUAFA16Pal6ce158",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\F4CryDCCEIyDu159\\ncSFhaiEMyDkUUAFA16Pal6ce158\\DuVgihyI9gaqEdio3jdhIHhC237",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qZNIbyL5203\\je207",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qZNIbyL5203\\je207\\XaB5u8l8IyXYsTAt7EhLpCdC1p97Rc7tgLmg169",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ra0DHqp98\\fgAJqE4ENpniqZqVsx940",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ra0DHqp98\\fgAJqE4ENpniqZqVsx940\\aggnQmIVGBZpCYDsJ0BvS7",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ncSFhaiEMyDkUUAFA16Pal6ce246\\DuVgihyI9gaqEdio3jdhIHhC139",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ncSFhaiEMyDkUUAFA16Pal6ce246\\DuVgihyI9gaqEdio3jdhIHhC139\\QrxyI49rfdPlV9fAUkIA00RI7rC75",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\je180\\XaB5u8l8IyXYsTAt7EhLpCdC1p97Rc7tgLmg130",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\je180\\XaB5u8l8IyXYsTAt7EhLpCdC1p97Rc7tgLmg130\\b7dnUWWQOvCTKPxFYFM4HWNIQvol13LmPlYFmEy52",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\fgAJqE4ENpniqZqVsx9125\\aggnQmIVGBZpCYDsJ0BvS246",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\fgAJqE4ENpniqZqVsx9125\\aggnQmIVGBZpCYDsJ0BvS246\\F4CryDCCEIyDu200",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuVgihyI9gaqEdio3jdhIHhC51\\QrxyI49rfdPlV9fAUkIA00RI7rC12",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuVgihyI9gaqEdio3jdhIHhC51\\QrxyI49rfdPlV9fAUkIA00RI7rC12\\qZNIbyL553",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\XaB5u8l8IyXYsTAt7EhLpCdC1p97Rc7tgLmg126\\b7dnUWWQOvCTKPxFYFM4HWNIQvol13LmPlYFmEy19",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\XaB5u8l8IyXYsTAt7EhLpCdC1p97Rc7tgLmg126\\b7dnUWWQOvCTKPxFYFM4HWNIQvol13LmPlYFmEy19\\ra0DHqp46",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\aggnQmIVGBZpCYDsJ0BvS85\\F4CryDCCEIyDu223",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\aggnQmIVGBZpCYDsJ0BvS85\\F4CryDCCEIyDu223\\ncSFhaiEMyDkUUAFA16Pal6ce219",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\QrxyI49rfdPlV9fAUkIA00RI7rC169\\qZNIbyL584",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\QrxyI49rfdPlV9fAUkIA00RI7rC169\\qZNIbyL584\\je33",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\b7dnUWWQOvCTKPxFYFM4HWNIQvol13LmPlYFmEy81\\ra0DHqp31",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\b7dnUWWQOvCTKPxFYFM4HWNIQvol13LmPlYFmEy81\\ra0DHqp31\\fgAJqE4ENpniqZqVsx9187",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\F4CryDCCEIyDu204\\Ob0WsFE1nzdM17kmLNU5oJ5",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\F4CryDCCEIyDu204\\Ob0WsFE1nzdM17kmLNU5oJ5\\OpfN7I3zAgIOpl1t132",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN22\\RKGD8rlG98dmqF177",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN22\\RKGD8rlG98dmqF177\\ny2HQH201",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy160\\Nd1p1g1g5sAps9dAXO6162",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy160\\Nd1p1g1g5sAps9dAXO6162\\CrC27k5BMqGgGnb244",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\z5bJw0pfuGO5e1rvcEd146\\CR5iRO55",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\z5bJw0pfuGO5e1rvcEd146\\CR5iRO55\\AuEZgvQ5cc78",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RXVvNtJe19\\ZyW2C7aQY5uusuQWRme0eQfH6DXHYxTaZss216",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RXVvNtJe19\\ZyW2C7aQY5uusuQWRme0eQfH6DXHYxTaZss216\\zjqBa3ONHnj7C173",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg196\\UajOsmDvMue3n6fzhjgX5h230",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg196\\UajOsmDvMue3n6fzhjgX5h230\\hZc5AvGJqPoKgUA3SKkkM4uLYd65ShVNtwiIT225",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\d34AJPXtDD8177\\G4uCwHoJTBOmB0mJIay126",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\d34AJPXtDD8177\\G4uCwHoJTBOmB0mJIay126\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN64",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ny2HQH84\\oKg2",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ny2HQH84\\oKg2\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy197",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\CrC27k5BMqGgGnb23\\kcAoeoA1Pu241",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\CrC27k5BMqGgGnb23\\kcAoeoA1Pu241\\z5bJw0pfuGO5e1rvcEd146",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\AuEZgvQ5cc103\\QzsICzHCmcsAUvX158",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\AuEZgvQ5cc103\\QzsICzHCmcsAUvX158\\RXVvNtJe13",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\zjqBa3ONHnj7C76\\w51hwaVviINs31tUrT2Za1YwOsDHWq2VlgEZIKJ161",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\zjqBa3ONHnj7C76\\w51hwaVviINs31tUrT2Za1YwOsDHWq2VlgEZIKJ161\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg128",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\hZc5AvGJqPoKgUA3SKkkM4uLYd65ShVNtwiIT136\\YJZw88kay3eDMEO154",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\hZc5AvGJqPoKgUA3SKkkM4uLYd65ShVNtwiIT136\\YJZw88kay3eDMEO154\\d34AJPXtDD8139",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN177\\RKGD8rlG98dmqF96",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN177\\RKGD8rlG98dmqF96\\ny2HQH235",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy65\\Nd1p1g1g5sAps9dAXO6165",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy65\\Nd1p1g1g5sAps9dAXO6165\\CrC27k5BMqGgGnb220",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\z5bJw0pfuGO5e1rvcEd8\\CR5iRO159",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\z5bJw0pfuGO5e1rvcEd8\\CR5iRO159\\AuEZgvQ5cc22",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RXVvNtJe204\\ZyW2C7aQY5uusuQWRme0eQfH6DXHYxTaZss117",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RXVvNtJe204\\ZyW2C7aQY5uusuQWRme0eQfH6DXHYxTaZss117\\zjqBa3ONHnj7C232",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg197\\UajOsmDvMue3n6fzhjgX5h218",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg197\\UajOsmDvMue3n6fzhjgX5h218\\hZc5AvGJqPoKgUA3SKkkM4uLYd65ShVNtwiIT20",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\d34AJPXtDD8137\\G4uCwHoJTBOmB0mJIay175",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\d34AJPXtDD8137\\G4uCwHoJTBOmB0mJIay175\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN11",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ny2HQH149\\oKg194",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ny2HQH149\\oKg194\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy11",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\CrC27k5BMqGgGnb69\\kcAoeoA1Pu175",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\CrC27k5BMqGgGnb69\\kcAoeoA1Pu175\\z5bJw0pfuGO5e1rvcEd241",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\AuEZgvQ5cc18\\QzsICzHCmcsAUvX72",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\AuEZgvQ5cc18\\QzsICzHCmcsAUvX72\\RXVvNtJe9",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\zjqBa3ONHnj7C190\\w51hwaVviINs31tUrT2Za1YwOsDHWq2VlgEZIKJ18",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\zjqBa3ONHnj7C190\\w51hwaVviINs31tUrT2Za1YwOsDHWq2VlgEZIKJ18\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg148",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\hZc5AvGJqPoKgUA3SKkkM4uLYd65ShVNtwiIT35\\YJZw88kay3eDMEO11",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\hZc5AvGJqPoKgUA3SKkkM4uLYd65ShVNtwiIT35\\YJZw88kay3eDMEO11\\d34AJPXtDD8193",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN105\\RKGD8rlG98dmqF76",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\gPYa4D2GDTDYKKFq9C8ZHrB6X3NHXZsyamyQN105\\RKGD8rlG98dmqF76\\ny2HQH103",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy99\\Nd1p1g1g5sAps9dAXO69",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\DuOqglkPp9r9KqU6YJnVe7UnWUXcPy99\\Nd1p1g1g5sAps9dAXO69\\CrC27k5BMqGgGnb94",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\z5bJw0pfuGO5e1rvcEd27\\CR5iRO42",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\z5bJw0pfuGO5e1rvcEd27\\CR5iRO42\\AuEZgvQ5cc50",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RXVvNtJe50\\ZyW2C7aQY5uusuQWRme0eQfH6DXHYxTaZss33",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RXVvNtJe50\\ZyW2C7aQY5uusuQWRme0eQfH6DXHYxTaZss33\\zjqBa3ONHnj7C36",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg89\\UajOsmDvMue3n6fzhjgX5h224",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\eELfyMpCQYTcfAJMqvVECNJsWSuk3G0jRdOYIg89\\UajOsmDvMue3n6fzhjgX5h224\\hZc5AvGJqPoKgUA3SKkkM4uLYd65ShVNtwiIT185",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\mH4HM81sZk97aC558ixBf8GorcWwv22\\kjCUBeYRZHTjgfskj0K0Wlg50xIQGSRh5PL159",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\mH4HM81sZk97aC558ixBf8GorcWwv22\\kjCUBeYRZHTjgfskj0K0Wlg50xIQGSRh5PL159\\RibTPmxBJJdjDduw5SJvkQ2dxmf33",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\X5hoJBuMDQ6b31BRHfGARY17QFpXDAZ60\\dW196",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\X5hoJBuMDQ6b31BRHfGARY17QFpXDAZ60\\dW196\\iwGRHPvpiy14180",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TUTyEiYKW4Y9VP173\\hUZdRT3h5egfKPZJwVAwI0Gv8109",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TUTyEiYKW4Y9VP173\\hUZdRT3h5egfKPZJwVAwI0Gv8109\\mH4HM81sZk97aC558ixBf8GorcWwv160",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RibTPmxBJJdjDduw5SJvkQ2dxmf77\\rRr3iQaf20",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RibTPmxBJJdjDduw5SJvkQ2dxmf77\\rRr3iQaf20\\X5hoJBuMDQ6b31BRHfGARY17QFpXDAZ137",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\iwGRHPvpiy14253\\Fd149",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\iwGRHPvpiy14253\\Fd149\\TUTyEiYKW4Y9VP59",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\mH4HM81sZk97aC558ixBf8GorcWwv98\\kjCUBeYRZHTjgfskj0K0Wlg50xIQGSRh5PL12",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\mH4HM81sZk97aC558ixBf8GorcWwv98\\kjCUBeYRZHTjgfskj0K0Wlg50xIQGSRh5PL12\\RibTPmxBJJdjDduw5SJvkQ2dxmf151",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\X5hoJBuMDQ6b31BRHfGARY17QFpXDAZ102\\dW120",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\X5hoJBuMDQ6b31BRHfGARY17QFpXDAZ102\\dW120\\iwGRHPvpiy1412",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TUTyEiYKW4Y9VP74\\hUZdRT3h5egfKPZJwVAwI0Gv8199",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TUTyEiYKW4Y9VP74\\hUZdRT3h5egfKPZJwVAwI0Gv8199\\mH4HM81sZk97aC558ixBf8GorcWwv45",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RibTPmxBJJdjDduw5SJvkQ2dxmf91\\rRr3iQaf138",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\RibTPmxBJJdjDduw5SJvkQ2dxmf91\\rRr3iQaf138\\uzIOT82",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\n3U8MLiMJwqo62iQSDWMDWzscLPHC113\\cUdThmavlI89",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\n3U8MLiMJwqo62iQSDWMDWzscLPHC113\\cUdThmavlI89\\qplrn4X81gizyn2lwUxUSYaLq74",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ZLmKcwbf33uLn20\\FiWMFHNnGscfXge5YSEj1L6SR1meBvWE3c159",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ZLmKcwbf33uLn20\\FiWMFHNnGscfXge5YSEj1L6SR1meBvWE3c159\\woFknLWCqbjQVnXz2qTNywRjVT179",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\FIp3pbddoYPGiGK4ZbDmpklbt190\\YMndL6yuLW32",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\FIp3pbddoYPGiGK4ZbDmpklbt190\\YMndL6yuLW32\\tpvTn91",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qplrn4X81gizyn2lwUxUSYaLq176\\NEHYgHrdn76HLBTO8FBkXlpJA83Ovh99",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qplrn4X81gizyn2lwUxUSYaLq176\\NEHYgHrdn76HLBTO8FBkXlpJA83Ovh99\\ZLmKcwbf33uLn122",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\woFknLWCqbjQVnXz2qTNywRjVT234\\Sfy45un5MpRafdbiOT9Ck4HYG6BtLmAyCNy7M124",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\woFknLWCqbjQVnXz2qTNywRjVT234\\Sfy45un5MpRafdbiOT9Ck4HYG6BtLmAyCNy7M124\\FIp3pbddoYPGiGK4ZbDmpklbt156",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\tpvTn234\\cUdThmavlI145",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\tpvTn234\\cUdThmavlI145\\qplrn4X81gizyn2lwUxUSYaLq246",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ZLmKcwbf33uLn109\\FiWMFHNnGscfXge5YSEj1L6SR1meBvWE3c152",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ZLmKcwbf33uLn109\\FiWMFHNnGscfXge5YSEj1L6SR1meBvWE3c152\\woFknLWCqbjQVnXz2qTNywRjVT64",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\FIp3pbddoYPGiGK4ZbDmpklbt233\\YMndL6yuLW73",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\FIp3pbddoYPGiGK4ZbDmpklbt233\\YMndL6yuLW73\\tpvTn121",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qplrn4X81gizyn2lwUxUSYaLq124\\NEHYgHrdn76HLBTO8FBkXlpJA83Ovh64",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qplrn4X81gizyn2lwUxUSYaLq124\\NEHYgHrdn76HLBTO8FBkXlpJA83Ovh64\\ZLmKcwbf33uLn163",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\woFknLWCqbjQVnXz2qTNywRjVT202\\Sfy45un5MpRafdbiOT9Ck4HYG6BtLmAyCNy7M50",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\woFknLWCqbjQVnXz2qTNywRjVT202\\Sfy45un5MpRafdbiOT9Ck4HYG6BtLmAyCNy7M50\\FIp3pbddoYPGiGK4ZbDmpklbt254",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\tpvTn165\\cUdThmavlI38",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\tpvTn165\\cUdThmavlI38\\qplrn4X81gizyn2lwUxUSYaLq16",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ZLmKcwbf33uLn51\\FiWMFHNnGscfXge5YSEj1L6SR1meBvWE3c110",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\ZLmKcwbf33uLn51\\FiWMFHNnGscfXge5YSEj1L6SR1meBvWE3c110\\woFknLWCqbjQVnXz2qTNywRjVT43",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\FIp3pbddoYPGiGK4ZbDmpklbt200\\YMndL6yuLW81",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\FIp3pbddoYPGiGK4ZbDmpklbt200\\YMndL6yuLW81\\tpvTn0",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qplrn4X81gizyn2lwUxUSYaLq246\\NEHYgHrdn76HLBTO8FBkXlpJA83Ovh253",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\qplrn4X81gizyn2lwUxUSYaLq246\\NEHYgHrdn76HLBTO8FBkXlpJA83Ovh253\\ZLmKcwbf33uLn74",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\woFknLWCqbjQVnXz2qTNywRjVT220\\Sfy45un5MpRafdbiOT9Ck4HYG6BtLmAyCNy7M7",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\woFknLWCqbjQVnXz2qTNywRjVT220\\Sfy45un5MpRafdbiOT9Ck4HYG6BtLmAyCNy7M7\\FIp3pbddoYPGiGK4ZbDmpklbt142",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\tpvTn46\\cUdThmavlI34",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\tpvTn46\\cUdThmavlI34\\qplrn4X81gizyn2lwUxUSYaLq204",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\aM1sk5U85\\khZ142",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\aM1sk5U85\\khZ142\\s6fYVD2KycbVm5YxNbGzs0UZ222",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\IXPPDFuJwvIXjVh138Bwy226kjwPRVnzZBkU32\\x0mZdIoLCw4G1",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\IXPPDFuJwvIXjVh138Bwy226kjwPRVnzZBkU32\\x0mZdIoLCw4G1\\CPtXHxJbevka439",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\XHmaYRxTjBf7PFoYKLStxI142\\UgIZEVf4GffqRe1245",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\XHmaYRxTjBf7PFoYKLStxI142\\UgIZEVf4GffqRe1245\\WEbMPPiF174",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\LJJpYtzWvMdz6HywIJbHaD192\\nh90rNHkWdVqufZXZNx2R66190",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\LJJpYtzWvMdz6HywIJbHaD192\\nh90rNHkWdVqufZXZNx2R66190\\qRQbH9LdrFiDl118",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\BbKPi0UNkicIla4VDNQT5ERcebGMH166\\p453mca231",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\BbKPi0UNkicIla4VDNQT5ERcebGMH166\\p453mca231\\hXzJ138",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\Q4l9zDJ2Zt6oJ3fE6LXhfrOjFWi5R38jjDOgHZ94\\e9DGvPr1tfxZ481kWbbga70",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\Q4l9zDJ2Zt6oJ3fE6LXhfrOjFWi5R38jjDOgHZ94\\e9DGvPr1tfxZ481kWbbga70\\X44",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\NKUkyUrUqCBPJJonFvyB5a2ZDCGk2tcOHkkwwil72\\IojzXKhOVUI16nGfgtM10m5248",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\NKUkyUrUqCBPJJonFvyB5a2ZDCGk2tcOHkkwwil72\\IojzXKhOVUI16nGfgtM10m5248\\TiJtewDjo8C3148",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\Ia4HiHThJddZH9Z8ajbLMczKJOs7L254\\mwpmFqt6RNN4kv49",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\Ia4HiHThJddZH9Z8ajbLMczKJOs7L254\\mwpmFqt6RNN4kv49\\AdLiRBh22azlMcW9PO2laqGcql150",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\mkbXAYrOmYFFojLqn173\\XHmaYRxTjBf7PFoYKLStxI156",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\mkbXAYrOmYFFojLqn173\\XHmaYRxTjBf7PFoYKLStxI156\\UgIZEVf4GffqRe1146",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\L8dFIX0MdhQ0211\\LJJpYtzWvMdz6HywIJbHaD240",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\L8dFIX0MdhQ0211\\LJJpYtzWvMdz6HywIJbHaD240\\nh90rNHkWdVqufZXZNx2R66151",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\c8s12\\BbKPi0UNkicIla4VDNQT5ERcebGMH208",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\c8s12\\BbKPi0UNkicIla4VDNQT5ERcebGMH208\\p453mca200",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\Ar0awDGAfS5naqEgWYCB87\\Q4l9zDJ2Zt6oJ3fE6LXhfrOjFWi5R38jjDOgHZ149",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\Ar0awDGAfS5naqEgWYCB87\\Q4l9zDJ2Zt6oJ3fE6LXhfrOjFWi5R38jjDOgHZ149\\e9DGvPr1tfxZ481kWbbga43",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\S7wyIEZfCcRh51\\NKUkyUrUqCBPJJonFvyB5a2ZDCGk2tcOHkkwwil6",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\S7wyIEZfCcRh51\\NKUkyUrUqCBPJJonFvyB5a2ZDCGk2tcOHkkwwil6\\IojzXKhOVUI16nGfgtM10m590",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\srw67\\Ia4HiHThJddZH9Z8ajbLMczKJOs7L187",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\srw67\\Ia4HiHThJddZH9Z8ajbLMczKJOs7L187\\mwpmFqt6RNN4kv157",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\QlpGS250\\RhnJKI9tC1I9",
    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\QlpGS250\\RhnJKI9tC1I9\\t5323"


* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: