PUA.Win32.Neoreklami.MANHSAJ

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following processes:

• cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• cmd /C mkdir "%Windows%\Temp\ifOKfREdsOIinPWn" && copy nul "%Windows%\Temp\ifOKfREdsOIinPWn\QZsWbSnQYqGcBCvB.vbs"
• wscript "%Windows%\Temp\ifOKfREdsOIinPWn\QZsWbSnQYqGcBCvB.vbs"
• schtasks /CREATE /TN "gpumGFMFZzz" /SC once /ST 13:31:37 /F /RU "{username}" /TR "rundll32 Userenv.dll,RefreshPolicy 1"
• schtasks /run /tn "gpumGFMFZzz"
• schtasks /DELETE /TN "gpumGFMFZzz" /F
• schtasks /END /TN "FULcDrXkapiwZYUIR"
• schtasks /DELETE /TN "FULcDrXkapiwZYUIR" /F
• schtasks /END /TN "FULcDrXkapiwZYUIR2"
• schtasks /DELETE /TN "FULcDrXkapiwZYUIR2" /F
• schtasks /END /TN "ofWRzzHEXWExyUyaJ"
• schtasks /DELETE /TN "ofWRzzHEXWExyUyaJ" /F
• schtasks /END /TN "ofWRzzHEXWExyUyaJ2"
• schtasks /DELETE /TN "ofWRzzHEXWExyUyaJ2" /F
• schtasks /END /TN "RKOFyrNufubkwtHsMYB"
• schtasks /DELETE /TN "RKOFyrNufubkwtHsMYB" /F
• schtasks /END /TN "RKOFyrNufubkwtHsMYB2"
• schtasks /DELETE /TN "RKOFyrNufubkwtHsMYB2" /F
• schtasks /END /TN "asBlntcxxePwPLvgqty"
• schtasks /DELETE /TN "asBlntcxxePwPLvgqty" /F
• schtasks /END /TN "asBlntcxxePwPLvgqty2"
• schtasks /DELETE /TN "asBlntcxxePwPLvgqty2" /F
• schtasks /END /TN "eBpcxlxlHWUtIYr"
• schtasks /DELETE /TN "eBpcxlxlHWUtIYr" /F
• schtasks /END /TN "eBpcxlxlHWUtIYr2"
• schtasks /DELETE /TN "eBpcxlxlHWUtIYr2" /F
• schtasks /END /TN "pbmNgseZPebvewb"
• schtasks /DELETE /TN "pbmNgseZPebvewb" /F
• schtasks /END /TN "pbmNgseZPebvewb2"
• schtasks /DELETE /TN "pbmNgseZPebvewb2" /F
• schtasks /END /TN "XmjJgjvdaoholz"
• schtasks /DELETE /TN "XmjJgjvdaoholz" /F
• schtasks /END /TN "AUQEDZTPBaurYR"
• schtasks /DELETE /TN "AUQEDZTPBaurYR" /F
• schtasks /END /TN "jppATblqBWsqx"
• schtasks /DELETE /TN "jppATblqBWsqx" /F
• schtasks /END /TN "jppATblqBWsqx2"
• schtasks /DELETE /TN "jppATblqBWsqx2" /F
• schtasks /END /TN "YlDvavfvTunDE"
• schtasks /DELETE /TN "YlDvavfvTunDE" /F
• schtasks /END /TN "YlDvavfvTunDE2"
• schtasks /DELETE /TN "YlDvavfvTunDE2" /F
• schtasks /CREATE /TR "rundll32 \"%Program Files%\ckITvBKiU\wECVfL.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "pbmNgseZPebvewb" /V1 /F
• schtasks /CREATE /TN "pbmNgseZPebvewb2" /xml "%Program Files%\ckITvBKiU\aEDIXsR.xml" /RU "SYSTEM"
• schtasks /CREATE /TN "AUQEDZTPBaurYR" /xml "%Program Files%\gKYGDLlpJGpU2\ZLAJSQU.xml" /RU "SYSTEM"
• schtasks /CREATE /TN "YlDvavfvTunDE2" /xml "%All Users Profile%\rhlHTWukGUOpiGVB\UjXYhXM.xml" /RU "SYSTEM"
• schtasks /CREATE /TN "ofWRzzHEXWExyUyaJ2" /xml "%Program Files%\HIkkUNZSbbflerszmJR\eVYlTdK.xml" /RU "SYSTEM"
• schtasks /CREATE /TN "asBlntcxxePwPLvgqty2" /xml "%Program Files%\gvVbsKPBHESOC\xGVWjxs.xml" /RU "SYSTEM"
• schtasks /CREATE /TN "spuqfEoqUOyG" /SC once /ST 06:45:21 /F /RU "{username}" /TR "\"%User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTM\kRLpUzASVpbfcizA.exe\" /comm wh"
• %System%\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• %System%\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• %System%\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• %System%\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\HIkkUNZSbbflerszmJR" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\ckITvBKiU" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gKYGDLlpJGpU2" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\gvVbsKPBHESOC" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\pzlaNnaJieUn" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Program Files%\xoxWAJcuxIE" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%All Users Profile%\rhlHTWukGUOpiGVB" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%AppDataLocal%Low\XhPLqiFznRSJY" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%User Temp%\nnDoSHYnMtCbSvqlq" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:32
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• "%System%\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%Windows%\Temp\ifOKfREdsOIinPWn" /t REG_DWORD /d 0 /reg:64
• taskeng.exe {C334FCF2-D969-4594-A8C6-9267ECB359E0} S-1-5-21-2407829820-1079796033-203259571-500:{computername}\{username}:Interactive:[1]
• %System%\rundll32.EXE Userenv.dll,RefreshPolicy 1
• "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe"
• %System%\svchost.exe -k LocalServiceAndNoImpersonation

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It creates the following folders:

• %Program Files%\xoxWAJcuxIE\files\_locales\zh_TW
• %Program Files%\xoxWAJcuxIE\files\_locales\mr
• %Program Files%\gvVbsKPBHESOC
• %All Users Profile%\rhlHTWukGUOpiGVB
• %Program Files%\xoxWAJcuxIE\files\_locales\cs
• %Program Files%\pzlaNnaJieUn
• %AppDataLocal%\Google\Chrome\User Data\SwReporter
• %Program Files%\xoxWAJcuxIE\files\_locales\lv
• %Windows%\Temp\ifOKfREdsOIinPWn
• %Program Files%\xoxWAJcuxIE\files\_locales
• %Program Files%\xoxWAJcuxIE\files\_locales\sr
• %System Root%\Program Files\Mozilla Firefox\browser
• %Program Files%\xoxWAJcuxIE\files\_locales\ca
• %Program Files%\xoxWAJcuxIE\files\_locales\pl
• %Program Files%\xoxWAJcuxIE\files\_locales\ms
• %Program Files%\xoxWAJcuxIE\files\_locales\en_GB
• %Program Files%\xoxWAJcuxIE\files\_locales\mk
• %Program Files%\xoxWAJcuxIE\files\_locales\ar
• %Program Files%\xoxWAJcuxIE\files\_locales\ru
• %Program Files%\xoxWAJcuxIE\files\_locales\zh_CN
• %Program Files%\xoxWAJcuxIE\files\_locales\sq
• %Program Files%\xoxWAJcuxIE\files\_locales\it
• %Program Files%\xoxWAJcuxIE\files\_locales\no
• %Program Files%\xoxWAJcuxIE\files\_locales\pt_BR
• %Program Files%\gKYGDLlpJGpU2
• %Program Files%\xoxWAJcuxIE\files\_locales\bg
• %Program Files%\xoxWAJcuxIE
• %Program Files%\xoxWAJcuxIE\files\_locales\hu
• %Program Files%\xoxWAJcuxIE\files\_locales\nl
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTM
• %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft
• %Program Files%\xoxWAJcuxIE\files\_locales\lt
• %Program Files%\xoxWAJcuxIE\files\_locales\sv
• %Program Files%\ckITvBKiU
• %Program Files%\xoxWAJcuxIE\files\_locales\sk
• %Program Files%\xoxWAJcuxIE\files\_locales\es
• %Program Files%\xoxWAJcuxIE\files\_locales\hr
• %Program Files%\xoxWAJcuxIE\files
• %Program Files%\xoxWAJcuxIE\files\_locales\id
• %Program Files%\xoxWAJcuxIE\files\_locales\uk
• %Program Files%\xoxWAJcuxIE\files\_locales\ja
• %Program Files%\xoxWAJcuxIE\files\_locales\ml
• %Program Files%\xoxWAJcuxIE\files\_locales\ro
• %Program Files%\xoxWAJcuxIE\files\_locales\fil
• %Program Files%\xoxWAJcuxIE\files\_locales\kn
• %Program Files%\xoxWAJcuxIE\files\_locales\en_US
• %Program Files%\xoxWAJcuxIE\files\_locales\hi
• %Program Files%\xoxWAJcuxIE\files\_locales\vi
• %Program Files%\xoxWAJcuxIE\files\_locales\da
• %Program Files%\xoxWAJcuxIE\files\_locales\pt
• %Program Files%\xoxWAJcuxIE\files\_locales\tr
• %Program Files%\xoxWAJcuxIE\files\_locales\am
• %Program Files%\xoxWAJcuxIE\files\_locales\be
• %Program Files%\xoxWAJcuxIE\files\_locales\es_419
• %Program Files%\xoxWAJcuxIE\files\_locales\ta
• %Program Files%\HIkkUNZSbbflerszmJR
• %User Temp%\nnDoSHYnMtCbSvqlq
• %Program Files%\xoxWAJcuxIE\files\_locales\ko
• %Program Files%\xoxWAJcuxIE\files\_locales\sw
• %Program Files%\xoxWAJcuxIE\files\_locales\bn
• %Program Files%\xoxWAJcuxIE\files\_locales\fr
• %Program Files%\xoxWAJcuxIE\files\_locales\el
• %Program Files%\xoxWAJcuxIE\files\_locales\pt_PT
• %Program Files%\xoxWAJcuxIE\files\_locales\fa
• %Program Files%\xoxWAJcuxIE\files\_locales\he
• %Program Files%\xoxWAJcuxIE\files\_locales\gu
• %Program Files%\xoxWAJcuxIE\files\_locales\fi
• %Program Files%\xoxWAJcuxIE\files\_locales\te
• %Program Files%\xoxWAJcuxIE\files\_locales\th
• %Program Files%\xoxWAJcuxIE\files\_locales\sl
• %Program Files%\xoxWAJcuxIE\files\_locales\et
• %Program Files%\xoxWAJcuxIE\files\_locales\en
• %Program Files%\xoxWAJcuxIE\files\_locales\de

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Potentially Unwanted Application registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004}

Other System Modifications

This Potentially Unwanted Application modifies the following file(s):

• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\permissions.sqlite
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\favicons.sqlite
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\addonStartup.json.lz4
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite
• %System Root%\Program Files\Mozilla Firefox\browser\omni.ja
• %Windows%\Temp\ifOKfREdsOIinPWn\QZsWbSnQYqGcBCvB.vbs
• %Windows%\Tasks\pbmNgseZPebvewb.job

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It deletes the following files:

• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\startupCache.8.little
• %Windows%\Tasks\ofWRzzHEXWExyUyaJ2.job
• %Windows%\Tasks\asBlntcxxePwPLvgqty2.job
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\scriptCache-child-current.bin
• %Windows%\Tasks\AUQEDZTPBaurYR.job
• %AppDataLocal%\Google\Chrome\User Data\SwReporter
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\favicons.sqlite.mlock
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\em004_64.dll
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\urlCache.bin
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\_metadata\verified_contents.json
• %Windows%\Tasks\FULcDrXkapiwZYUIR2.job
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pings
• %Windows%\Tasks\XmjJgjvdaoholz.job
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTM
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\manifest.fingerprint
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\webext.sc.lz4
• %System%\GroupPolicy
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\em001_64.dll
• %Windows%\Tasks\jppATblqBWsqx.job
• %Windows%\Tasks\RKOFyrNufubkwtHsMYB.job
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\manifest.json
• %Windows%\Tasks\RKOFyrNufubkwtHsMYB2.job
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite.mlock
• %Windows%\Tasks\jppATblqBWsqx2.job
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\urlCache-current.bin
• %System Root%\Program Files\Mozilla Firefox\browser\omni.ja.mlock
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\em005_64.dll
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\software_reporter_tool.exe
• %Windows%\Tasks\eBpcxlxlHWUtIYr.job
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\addonStartup.json.lz4.mlock
• %Windows%\Tasks\pbmNgseZPebvewb2.job
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\scriptCache-child.bin
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\em002_64.dll
• %Windows%\Tasks\ofWRzzHEXWExyUyaJ.job
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\em000_64.dll
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js.mlock
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\scriptCache.bin
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY\scriptCache-current.bin
• %Windows%\Tasks\asBlntcxxePwPLvgqty.job
• %Windows%\Tasks\eBpcxlxlHWUtIYr2.job
• %Windows%\Tasks\YlDvavfvTunDE2.job
• %Windows%\Tasks\YlDvavfvTunDE.job
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\edls_64.dll
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCache
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\em003_64.dll
• %Windows%\Tasks\gpumGFMFZzz.job
• %Windows%\Tasks\FULcDrXkapiwZYUIR.job

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It deletes the following folders:

• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg\40.200.201.3\_metadata
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingswuQZbstsyY
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg
• %System%\GroupPolicymmsNuIaukB

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Threats\
ThreatIDDefaultAction
225451 = "6"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node
global UID = "7039BE0AC891460B8C2794A2C55000ED"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Chrome\ExtensionInstallWhitelist
1 = "hbbadcmbpgmbdlecggopiocgfbkcgona"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Chrome\ExtensionInstallWhitelist
2 = "hdpeaegihbnfellpdiiabeljgdpoalpl"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{DD2C0C94-16A1-40A7-9122-A21C3E1B8A95}
(Default) = "BackgroundScriptEngine Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{DD2C0C94-16A1-40A7-9122-A21C3E1B8A95}\
Programmable
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{DD2C0C94-16A1-40A7-9122-A21C3E1B8A95}\
LocalServer32
(Default) = "%Program Files%\xoxWAJcuxIE\bMFmvKyWTy.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Internet Explorer\Low Rights\
ElevationPolicy\{DD2C0C94-16A1-40A7-9122-A21C3E1B8A95}
AppName = "bMFmvKyWTy.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Internet Explorer\Low Rights\
ElevationPolicy\{DD2C0C94-16A1-40A7-9122-A21C3E1B8A95}
AppPath = "%Program Files%\xoxWAJcuxIE"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Internet Explorer\Low Rights\
ElevationPolicy\{DD2C0C94-16A1-40A7-9122-A21C3E1B8A95}
Policy = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9568F6B2-836D-4689-950C-630B44F6B91A}
(Default) = "_IhShPPFjm[mxk}VNqrF-Events"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9568F6B2-836D-4689-950C-630B44F6B91A}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9568F6B2-836D-4689-950C-630B44F6B91A}\
TypeLib
(Default) = "{774C4A9B-28A9-4438-9BD5-2A34282EC85E}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9568F6B2-836D-4689-950C-630B44F6B91A}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C6792C17-F3C7-48DA-99F2-BDEC79819AEB}
(Default) = "IhShPPFjm[mxk}VNqrF-"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C6792C17-F3C7-48DA-99F2-BDEC79819AEB}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C6792C17-F3C7-48DA-99F2-BDEC79819AEB}\
TypeLib
(Default) = "{774C4A9B-28A9-4438-9BD5-2A34282EC85E}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C6792C17-F3C7-48DA-99F2-BDEC79819AEB}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
(Default) = "YoutubeAdBlock"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
NoExplorer = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
(Default) = "YoutubeAdBlock"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
ProgID = "Toolbar.ExtensionHelperObject.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
VersionIndependentProgID = "Toolbar.ExtensionHelperObject"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
TypeLib = "{1D5A4199-956E-49BC-B89F-6A35C57C0D13}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\
Programmable
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\
Implemented Categories
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\
Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\
InprocServer32
(Default) = "%Program Files%\xoxWAJcuxIE\kA8GErwd.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{D916D84B-C467-4640-B01F-EDC58CCCC2AA}
(Default) = "{D916D84B-C467-4640-B01F-EDC58CCCC2AA}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{D916D84B-C467-4640-B01F-EDC58CCCC2AA}\
ProxyStubClsid
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{D916D84B-C467-4640-B01F-EDC58CCCC2AA}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{D916D84B-C467-4640-B01F-EDC58CCCC2AA}\
TypeLib
(Default) = "{1A3BEEDB-4CA0-4693-8AA2-142BB8064EE9}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{D916D84B-C467-4640-B01F-EDC58CCCC2AA}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
(Default) = "YoutubeAdBlock"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
NoExplorer = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
(Default) = "YoutubeAdBlock"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
ProgID = "Toolbar.ExtensionHelperObject.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
VersionIndependentProgID = "Toolbar.ExtensionHelperObject"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}
TypeLib = "{1D5A4199-956E-49BC-B89F-6A35C57C0D13}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\Programmable
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\Implemented Categories
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\Implemented Categories\
{59FB2056-D625-48D0-A944-1A85B5AB2640}
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\InprocServer32
(Default) = "%Program Files%\xoxWAJcuxIE\tjJmxXgn.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004}\InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
DisplayName = "YoutubeAdBlock"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
DisplayVersion = "2.0.0.1011"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
Publisher = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
URLInfoAbout = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
UninstallString = "rundll32 %Program Files%\pzlaNnaJieUn\pbishskwHu.dll,#1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%Windows%\Temp
ifOKfREdsOIinPWn = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Windows%\Temp
ifOKfREdsOIinPWn = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
HIkkUNZSbbflerszmJR = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
HIkkUNZSbbflerszmJR = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
ckITvBKiU = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
ckITvBKiU = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
gKYGDLlpJGpU2 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
gKYGDLlpJGpU2 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
gvVbsKPBHESOC = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
gvVbsKPBHESOC = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
pzlaNnaJieUn = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
pzlaNnaJieUn = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
xoxWAJcuxIE = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%
xoxWAJcuxIE = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%All Users Profile%
rhlHTWukGUOpiGVB = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%All Users Profile%
rhlHTWukGUOpiGVB = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%AppDataLocal%Low
XhPLqiFznRSJY = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%AppDataLocal%Low
XhPLqiFznRSJY = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows Defender\Exclusions\
Paths\%User Temp%
nnDoSHYnMtCbSvqlq = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%User Temp%
nnDoSHYnMtCbSvqlq = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{{GUID}}
StartTimeLo = "2152161662"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{{GUID}}
StartTimeHi = "30766396"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{{GUID}}
EndTimeLo = "2481001664"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{{GUID}}
EndTimeHi = "30766396"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{{GUID}}
Status = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{{GUID}}
LoggingStatus = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History
PolicyOverdue = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions
Exclusions_Paths = "1"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
Site-Name = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
Distinguished-Name = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
SlowLink = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
Version = "2258732705"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
WQLFilterPass = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
AccessDenied = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
GPO-Disabled = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
Options = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
GPOID = "Local Group Policy"

(Note: The default value data of the said registry entry is Local Group Policy.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
SOM = "Local"

(Note: The default value data of the said registry entry is Local.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
DisplayName = "Local Group Policy"

(Note: The default value data of the said registry entry is Local Group Policy.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
WQL-Id = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
Enabled = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
NoOverride = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
DsPath = "LocalGPO"

(Note: The default value data of the said registry entry is LocalGPO.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
SOM = "Local"

(Note: The default value data of the said registry entry is Local.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Exclusions_Paths

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%\HIkkUNZSbbflerszmJR

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%\ckITvBKiU

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%\gKYGDLlpJGpU2

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%\gvVbsKPBHESOC

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%\pzlaNnaJieUn

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Program Files%\xoxWAJcuxIE

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%All Users Profile%\rhlHTWukGUOpiGVB

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%AppDataLocal%Low\XhPLqiFznRSJY

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%User Temp%\nnDoSHYnMtCbSvqlq

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions\
Paths\%Windows%\Temp\
ifOKfREdsOIinPWn

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Chrome\ExtensionInstallWhitelist\
1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Chrome\ExtensionInstallWhitelist\
2

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %System%\GroupPolicyqElubNdCzq
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheRvyFIfLxxT
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMzUxOIIHRTY
• %AppDataLocal%\Google\Chrome\User Data\SwReporterYXwOpRfNYQ
• %Program Files%\xoxWAJcuxIE\files\_locales\no\messages.json
• %System%\GroupPolicyTXaZzydPJs
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsCXNaFosffV
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheIHDzNAsGeg
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMpXSlGAZGsM
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingswZaAtloooX
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js
• %System%\GroupPolicycBWhcprUrR
• %AppDataLocal%\Google\Chrome\User Data\SwReporterviDqzfOozp
• %Program Files%\xoxWAJcuxIE\files\_locales\kn\messages.json
• %System%\GroupPolicypSzbjrhDMk
• %Program Files%\xoxWAJcuxIE\files\background.html
• %Program Files%\xoxWAJcuxIE\files\_locales\bg\messages.json
• %Program Files%\xoxWAJcuxIE\files\_locales\ms\messages.json
• %System%\GroupPolicyPgKOvXmwKP
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheczqHwtWCfd
• %System%\GroupPolicyHqGGDgEIaC
• %System%\GroupPolicydfwtTZzpkC
• %AppDataLocal%\Google\Chrome\User Data\SwReporteryZCrkBCKcR
• %System%\GroupPolicyynhYHYfRKj
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachewNQIcLPSpk
• %AppDataLocal%\Google\Chrome\User Data\SwReporterPdaLXUivoF
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMZRxSlqDzed
• %AppDataLocal%\Google\Chrome\User Data\SwReporterrQNoZHvwsf
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachevYSJBjVLBS
• %System%\GroupPolicygRqiWSmcqF
• %AppDataLocal%\Google\Chrome\User Data\SwReporterNtMooDeuKD
• %Program Files%\xoxWAJcuxIE\files\Kernel.js
• %System%\GroupPolicyVSSjhpmalE
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMwMeVDqqMKr
• %AppDataLocal%\Google\Chrome\User Data\SwReporterntvCFaGpvT
• %Program Files%\xoxWAJcuxIE\files\_locales\id\messages.json
• %System%\GroupPolicybxEXeiTnBO
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMWrFCXbIABj
• %AppDataLocal%\Google\Chrome\User Data\SwReporterbGIuUNgpXL
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMSEZLpqTZjF
• %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec
• %AppDataLocal%\Google\Chrome\User Data\SwReporterMToAQLUZjn
• %AppDataLocal%\Google\Chrome\User Data\SwReporterDlsTsOpFVH
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachesyRaTnKgta
• %System%\GroupPolicyWovnFjuEqi
• %System%\GroupPolicyPcNlfoADDz
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMHGWhTJuVWu
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsHOpNjAAjWT
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheptZLVgSItR
• %System%\GroupPolicyakkBzSijho
• %System%\GroupPolicyXsgWmqCWIe
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheLSSVcRZYCy
• %Program Files%\xoxWAJcuxIE\tjJmxXgn.dll
• %System%\GroupPolicytqUcSWdNOr
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsyZIcObtBmK
• %AppDataLocal%\Microsoft\Media Player\CurrentDatabase_372.wmdb
• %System Root%\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMXILzbeohNP
• %System%\GroupPolicyyMGUmEzeoA
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachegGHvEgEYxq
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMzqEJACyHHY
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMYjpCbvHRlC
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsYpWGqhfKZD
• %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds
• %Program Files%\xoxWAJcuxIE\files\_locales\sw\messages.json
• %System%\GroupPolicyuArkNJAUrj
• %System%\GroupPolicyMVYvAGHFLf
• %System%\GroupPolicypnpLkfwYQi
• %AppDataLocal%\Google\Chrome\User Data\SwReporterXVuHilOzzQ
• %System%\GroupPolicyDPzhhTNIFy
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMotsaqWHMnc
• %System%\GroupPolicyKZnvnpigPm
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingskIrcsBhwLo
• %System%\GroupPolicyQpzXXprQNY
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMNSQYOENDHi
• %AppDataLocal%\Google\Chrome\User Data\SwReporteroDguCYxAwI
• %System%\GroupPolicyVsDKjvpOwE
• %System%\GroupPolicylmgJBgLByo
• %AppDataLocal%\Google\Chrome\User Data\SwReporterKgTlwAkZtW
• %AppDataLocal%\Google\Chrome\User Data\SwReporterfjuPUunYpp
• %AppDataLocal%\Google\Chrome\User Data\SwReporterPiNlUhOJfr
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMlenUQuViXj
• %Program Files%\xoxWAJcuxIE\files\_locales\el\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheBAVKhZxtTw
• %System%\GroupPolicyagJlGYbTGw
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachesnVGoSrtwM
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\permissions.sqlite
• %Program Files%\xoxWAJcuxIE\files\_locales\et\messages.json
• %AppDataLocal%\Google\Chrome\User Data\SwReporterCnjUNmqkjq
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheuiaoPfkXBz
• %AppDataLocal%\Google\Chrome\User Data\SwReporterjrJdqPuXeZ
• %System%\GroupPolicyNceGKnEQWY
• %System%\GroupPolicysbaWJPFNNG
• %System%\GroupPolicyDBxaCxvhRJ
• %System%\GroupPolicyeOLNGHfzDy
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheplyMYOMvXl
• %Program Files%\xoxWAJcuxIE\files\_locales\es\messages.json
• %System%\GroupPolicySqmZkZILLJ
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheMUHBtonzMu
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\addonStartup.json.lz4
• %System%\GroupPolicyPkRGQSHpEw
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMRzPdVdJDmo
• %System%\GroupPolicynueCTRcYbg
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingseETaGSNQnR
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsPHGUljAoxn
• %System%\GroupPolicyGkiFzRmBbg
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheOZShUFHbmb
• %Program Files%\gvVbsKPBHESOC\fzrQDTg.dll
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsWzoPBeiUzg
• %System%\GroupPolicyeoYxTMNxwz
• %Program Files%\xoxWAJcuxIE\files\_locales\lv\messages.json
• %System%\GroupPolicypmtQhWOoce
• %Program Files%\xoxWAJcuxIE\files\_locales\da\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsPbjslTuRTc
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsDPuwyyKCeU
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsMIxeMcJREG
• %Program Files%\xoxWAJcuxIE\files\_locales\te\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachepQJsHcNdcq
• %AppDataLocal%\Google\Chrome\User Data\SwReporterPvWfRsreLO
• %System%\GroupPolicyRBTtbXraqe
• %System%\GroupPolicyyidPmZsfym
• %System%\GroupPolicyQOurIuQuwI
• %Program Files%\xoxWAJcuxIE\bMFmvKyWTy.exe
• %System%\GroupPolicyEoElenqaTU
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsdWVLeWZKAB
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMZZMwGBHIEV
• %System%\GroupPolicyRmficERBZp
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMgIMjqcAYaI
• %System%\GroupPolicypAasAqCMjy
• %AppDataLocal%\Google\Chrome\User Data\SwReporteruwtzrRRTBs
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheyUYnKbirmu
• %System%\GroupPolicyXiYRKmrrJj
• %System%\GroupPolicyQpzmyurwzt
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheYbAgUeGVYS
• %Program Files%\xoxWAJcuxIE\files\_locales\nl\messages.json
• %Program Files%\HIkkUNZSbbflerszmJR\eVYlTdK.xml
• %System%\GroupPolicyYgJUZMuPfG
• %AppDataLocal%\Google\Chrome\User Data\SwReporterwkLZSKiXjJ
• %AppDataLocal%\Google\Chrome\User Data\SwReporterkobCzVCdII
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheuLXejOmLUb
• %Program Files%\xoxWAJcuxIE\files\_locales\sl\messages.json
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMXConiWzTlP
• %System%\GroupPolicyKQYoUDykAy
• %AppDataLocal%\Google\Chrome\User Data\SwReportererbadhMsvH
• %System%\GroupPolicycQmVUPgySK
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMqLTaLJyadc
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMaTKgAVCdwn
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsMYLIiAxwMM
• %AppDataLocal%\Google\Chrome\User Data\SwReporterPenGnMSBha
• %System%\GroupPolicyUcGNSYYVxY
• %System%\GroupPolicyJRAAHbIpDM
• %AppDataLocal%\Google\Chrome\User Data\SwReporterLwKwXgmkOq
• %AppDataLocal%\Google\Chrome\User Data\SwReporterGOeMbvxwCS
• %System%\GroupPolicyRgpZYMMAcf
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheFTCuZHEndx
• %Program Files%\xoxWAJcuxIE\files\_locales\pt_BR\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\favicons.sqlite-shm
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsXkYuNqMOLM
• %System%\GroupPolicyGYYGlUphxX
• %Program Files%\xoxWAJcuxIE\files\_locales\he\messages.json
• %System%\GroupPolicyoZMFXalaTy
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsumPcPEcvvh
• %All Users Profile%\rhlHTWukGUOpiGVB\qeCtrQJ.wsf
• %System%\GroupPolicyCRMoFGPGVw
• %System%\GroupPolicyeBarnyPJhV
• %AppDataLocal%\Google\Chrome\User Data\SwReporterdckvOqZjWL
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsKaDgYkNRLk
• %AppDataLocal%\Google\Chrome\User Data\SwReporterPYqjafyoJK
• %System%\GroupPolicyrMBDmuCCZI
• %Program Files%\xoxWAJcuxIE\files\_locales\mr\messages.json
• %System%\GroupPolicyRCzUxnBVbA
• %AppDataLocal%\Google\Chrome\User Data\SwReporteroLzYvPHrEh
• %Program Files%\xoxWAJcuxIE\kA8GErwd.dll
• %System%\GroupPolicyRZBTCTfgTX
• %AppDataLocal%\Google\Chrome\User Data\SwReporterfLuDKxEhHt
• %System%\GroupPolicyfYaYmiRPve
• %AppDataLocal%\Google\Chrome\User Data\SwReporterhNwXVhjyUP
• %System%\GroupPolicydwCHHIkCwc
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsroQwYjaFxd
• %System%\GroupPolicytbCsKVTdqv
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMdJYcyXkeuF
• %System%\GroupPolicyCxwUgmkuNd
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsJmxYWjbFve
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheNcpJJAxEKC
• %System%\GroupPolicyZXBdStnxKz
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsmHcnrqPUbQ
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTXBEHiVHjY
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheWmmZQYKPQa
• %System%\GroupPolicyTdUATsZqbW
• %System%\GroupPolicyNgbACWcqOp
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsNPsROZgCkV
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachezQLsTFHmQC
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheVfEBdtWHSv
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachepojieSCTYY
• %AppDataLocal%\Google\Chrome\User Data\SwReporterHeSjEMZWcB
• %System%\GroupPolicyqndxpmBulx
• %AppDataLocal%\Google\Chrome\User Data\SwReporteruffselnmdg
• %System%\GroupPolicyuZxxqxUafh
• %AppDataLocal%\Google\Chrome\User Data\SwReporterdyUqvnjiWy
• %AppDataLocal%\Google\Chrome\User Data\SwReporterflRoQfcPoy
• %AppDataLocal%\Google\Chrome\User Data\SwReporternaEaBjKNuz
• %System%\GroupPolicyxjVfAtrjfX
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMXXjPvYmARD
• %System%\GroupPolicypGeqHCelSj
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMpvZNzHJyif
• %System%\GroupPolicyqaKoWJjxMe
• %AppDataLocal%\Google\Chrome\User Data\SwReporterGjNQFUGoHj
• %System%\GroupPolicyEhBPZyPnaA
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachenJEHRyAvnn
• %AppDataLocal%\Google\Chrome\User Data\SwReporterkIbZVFfVTW
• %AppDataLocal%\Google\Chrome\User Data\SwReporteriZZmmDbWIe
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMnQAdpNTvrX
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsndHvivhZws
• %Program Files%\xoxWAJcuxIE\files\_locales\hi\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachekZYQAskCbN
• %All Users Profile%\tempntuser.pol
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMGblutLahMv
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsZXvCMAgXBr
• %System%\GroupPolicyZntcfFSlED
• %System%\GroupPolicyywZwODsfNN
• %Program Files%\xoxWAJcuxIE\files\_locales\bn\messages.json
• %System%\GroupPolicyZSEoeVxHHU
• %System%\GroupPolicyiPbTNTPgNR
• %System%\GroupPolicyHTIkfLwMuR
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheXDoONmZXYF
• %AppDataLocal%\Google\Chrome\User Data\SwReporterQPGkWLPvMd
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMRmfhpewZPm
• %System%\GroupPolicyHcviLSndRD
• %Program Files%\xoxWAJcuxIE\files\_locales\es_419\messages.json
• %System%\GroupPolicyjoaCxEuomI
• %System%\GroupPolicyCCbvLJqGNZ
• %System%\GroupPolicyFFSmOolwdq
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheLwgGZvFRZG
• %AppDataLocal%\Google\Chrome\User Data\SwReporterTlsDGqsfAt
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMDfHBkRftiB
• %System%\GroupPolicyzWnhVQaBvm
• %Program Files%\xoxWAJcuxIE\files\_locales\sr\messages.json
• %Program Files%\xoxWAJcuxIE\files\_locales\zh_TW\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingslJTVAydPuN
• %System%\GroupPolicyDVTVhvOUgV
• %System%\GroupPolicysDUWOsksWM
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMYYBVWrClvG
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsCPKAdKOIrf
• %AppDataLocal%\Google\Chrome\User Data\SwReporteroUNxZsdZjZ
• %System%\GroupPolicyPFAfeLfcJk
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsZBIVntZDHS
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMIWOWTYZmBA
• %System%\GroupPolicyYSPKVuwWbu
• %System%\GroupPolicyWYyHwncZVL
• %System%\GroupPolicytgaUpKvApC
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqihMZPodWg
• %AppDataLocal%\Google\Chrome\User Data\SwReporterToXvujWwNo
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingshHlnVbvkrV
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqpWlnPPIvw
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsiuSYjfoYqX
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsSGrwjUmVME
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsrKUZboehsx
• %AppDataLocal%\Google\Chrome\User Data\SwReporterIoKMqAErTo
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMKTfohczJJV
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMBNGTDRgwgd
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMrcrtNPeBRq
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMZjQUUILOee
• %System%\GroupPolicyKBunllqgIr
• %Program Files%\xoxWAJcuxIE\files\_locales\de\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsiwrqtKDwOG
• %System%\GroupPolicyKOoycvjXjR
• %AppDataLocal%\Google\Chrome\User Data\SwReporterSFMLkNIeff
• %Program Files%\xoxWAJcuxIE\files\_locales\fil\messages.json
• %System%\GroupPolicyeiZnuLEAtd
• %Program Files%\xoxWAJcuxIE\files\_locales\zh_CN\messages.json
• %System%\GroupPolicyupjcsfRxQM
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsDgLVxLwcgw
• %AppDataLocal%\Google\Chrome\User Data\SwReporterExRsjYtRsT
• %AppDataLocal%\Google\Chrome\User Data\SwReporterlYgJQTQcLJ
• %System%\GroupPolicymClmLGBTsX
• %AppDataLocal%\Google\Chrome\User Data\SwReporternwvOCeNtbR
• %AppDataLocal%\Google\Chrome\User Data\SwReporterTuUUmidTnp
• %Program Files%\xoxWAJcuxIE\files\_locales\be\messages.json
• %System%\GroupPolicyEnnNZkqbTY
• %System%\GroupPolicymhFkJhSLsf
• %System%\GroupPolicyArJdRlNmvd
• %AppDataLocal%\Google\Chrome\User Data\SwReporterraXnZhwslm
• %System%\GroupPolicyxlOnHLnLUp
• %System%\GroupPolicystHTisIlsv
• %System%\GroupPolicykCRdpccoYb
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsHTcHxZssHU
• %Program Files%\xoxWAJcuxIE\files\_locales\ml\messages.json
• %System%\GroupPolicyWcAgHMRyCA
• %AppDataLocal%\Google\Chrome\User Data\SwReportertaRMmcZRnW
• %System%\GroupPolicyLzdLgwqfeJ
• %System%\GroupPolicyiiFtiJPJFT
• %Program Files%\xoxWAJcuxIE\files\_locales\en_GB\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheZohxBIrsRL
• %System%\GroupPolicySrnZGFWUmd
• %AppDataLocal%\Google\Chrome\User Data\SwReporterVYxUHKAqAt
• %Program Files%\gKYGDLlpJGpU2\ZLAJSQU.xml
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMvcIAwImIjS
• %AppDataLocal%\Google\Chrome\User Data\SwReporterpiJFGznVhB
• %System%\GroupPolicyxGIyTrjKLr
• %System%\GroupPolicyvDsZPQSRMp
• %System%\GroupPolicysoAjlJEBQw
• %System%\GroupPolicyDsgGZjisgW
• %System%\GroupPolicyLXpxnYZMfE
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsDQtZaRHxXq
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsLUcSyleAbT
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsBOpoOSgqkg
• %System%\GroupPolicyLHUJRMIjtH
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMfzwiQmlhJP
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMfiBQeMjagL
• %All Users Profile%\rhlHTWukGUOpiGVB\UjXYhXM.xml
• %System%\GroupPolicyRdMMdSkubj
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheiyuxxDRqjC
• %System%\GroupPolicyEPoxHrcwJN
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMJVsgELxvRw
• %System%\GroupPolicydCcBykfcIr
• %System%\GroupPolicyeBrVpEkfRP
• %System%\GroupPolicyXJzpvxSmsK
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachediTWhOpSCd
• %System%\GroupPolicyZqedzGcCax
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsJRKJKMdVqC
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMGoZXtAsmEo
• %System%\GroupPolicyfnFEcvWZIT
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMJtIkHqgMJF
• %System%\GroupPolicyTseXOCckAM
• %System%\GroupPolicyMDqLaMUWRk
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\favicons.sqlite
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsEbAcxDAvQb
• %AppDataLocal%\Google\Chrome\User Data\SwReporternSNcvfDwjB
• %System%\GroupPolicyyFYJJblRzf
• %System%\GroupPolicyhOEbtqrUuz
• %System%\GroupPolicyExOHurTkVl
• %Program Files%\xoxWAJcuxIE\files\_locales\fa\messages.json
• %System%\GroupPolicyNUVDXWkarJ
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\permissions.sqlite-journal
• %Program Files%\xoxWAJcuxIE\files\_locales\ja\messages.json
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMwDIJXZAnvJ
• %System%\GroupPolicyYHbjXvmYho
• %System%\GroupPolicySoCpnOOunn
• %System%\GroupPolicylwGeVNCcyo
• %System%\GroupPolicypEjsryHXTj
• %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
• %AppDataLocal%\Google\Chrome\User Data\SwReporterxuCZhBkQFG
• %System%\GroupPolicynwUzAzEULj
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheeLwAJIZMJw
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMobQFqlKzWE
• %Program Files%\xoxWAJcuxIE\files\_locales\ru\messages.json
• %System%\GroupPolicyXFMJqYCGJB
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheyBJirrZIsI
• %System%\GroupPolicyKWAgHQsUvl
• %Program Files%\xoxWAJcuxIE\TxFph.dll
• %System%\GroupPolicyiqpbxcODwe
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMONeWftOmNT
• %Program Files%\pzlaNnaJieUn\pbishskwHu.dll
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachevZkHGgerWk
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheBGpNRtfRex
• %AppDataLocal%\Google\Chrome\User Data\SwReporterHgVVJvErjO
• %System%\GroupPolicyvCZgVmvjyu
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsaOXWRawHvE
• %System%\GroupPolicytlzbpbCbpn
• %System%\GroupPolicyGwliMjoWYH
• %System%\GroupPolicyJxkhDbmLab
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsnIiewyHVMz
• %System%\GroupPolicyyamglgnwsk
• %All Users Profile%\ntuser.pol
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheLIEulkURmz
• %System%\GroupPolicyiauIBoIPWt
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMmVAqcGNoiv
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMifpyZoEczK
• %Program Files%\xoxWAJcuxIE\files\_locales\it\messages.json
• %System%\GroupPolicyrKdVIYGZNg
• %System%\GroupPolicyOAqKDqbbmc
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMpLRnyWHprQ
• %System%\GroupPolicyiRYmJUBxkL
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingshledPPHCfr
• %Program Files%\xoxWAJcuxIE\files\_locales\mk\messages.json
• %AppDataLocal%\Google\Chrome\User Data\SwReportercDyhgxRNMQ
• %AppDataLocal%\Google\Chrome\User Data\SwReporterwxsUjfdcaf
• %AppDataLocal%\Google\Chrome\User Data\SwReporterzlcpudrdEA
• %System%\GroupPolicyqPCrdxOmeT
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheHgQpwDSRds
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsCCcylfpIxb
• %System%\GroupPolicyHBxWUVadqe
• %System%\GroupPolicyKAmjNRvsyQ
• %System%\GroupPolicyJGqbrRVluP
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMysalvqVpRt
• %System%\GroupPolicyaYAAFLTNNu
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsZAvLBRFJMZ
• %System%\GroupPolicyzokrzmPwJc
• %System%\GroupPolicyUAhtyJYcvz
• %System%\GroupPolicyyoxBgfPdvF
• %Program Files%\xoxWAJcuxIE\files\_locales\hr\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsqQHVdsCTGO
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheVQOGanBete
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMTjtYhQAlxd
• %System%\GroupPolicyWIgpFzsPOL
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingssQyOpMxYAn
• %AppDataLocal%\Google\Chrome\User Data\SwReporterTmrUbTFsno
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachecNzgYZyjeZ
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsIpWVApJPKO
• %System%\GroupPolicyucjOMmNxIb
• %System%\GroupPolicyboreeLZNvl
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMAEpjZPTeFI
• %AppDataLocal%\Google\Chrome\User Data\SwReporterNYvYNPyCMF
• %System%\GroupPolicyqwERlgLNKv
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacherrgJcZaYbr
• %System%\GroupPolicyjTXYgUFbeK
• %System%\GroupPolicyRcAzDZWdwt
• %System%\GroupPolicyYBWwfIGGwY
• %System%\GroupPolicyBLeCYwjyrT
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheexCJqZQIDf
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMfgZOwGpttI
• %System%\GroupPolicyBEOiuHKRaW
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMloHUeTHLcx
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachegTxOhSieJF
• %System%\GroupPolicyTrwqZkhvzD
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMiPVorPUPdc
• %Program Files%\xoxWAJcuxIE\files\_locales\hu\messages.json
• %System%\GroupPolicynkvorNNdBH
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTM\kRLpUzASVpbfcizA.exe
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsWIhwcxqjSU
• %AppDataLocal%\Google\Chrome\User Data\SwReporterjHhvcEWWPV
• %System%\GroupPolicyQVZUtvAeLB
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTUXgVDCocA
• %AppDataLocal%\Google\Chrome\User Data\SwReporterlpMVwWduIj
• %All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMWCTRGkMTWd
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMwLxxzRGoQk
• %System%\GroupPolicyaPRDUCmXaz
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMOFBtRXmOIU
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheVaCwrVOvfX
• %System%\GroupPolicycePabLZJaP
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsUfiEXiUyJM
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsSFlvFZcTAx
• %System%\GroupPolicySMgOcTNpjS
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMcKBwDDhHPi
• %AppDataLocal%\Google\Chrome\User Data\SwReportervDulwClnqa
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMheboNtSWBp
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsYFxAPIRMOl
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheXWHqKNOkUc
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsIjTyWEkHDv
• %System%\GroupPolicyrwxgRlGrbj
• %System%\GroupPolicyeXdtPbMxVZ
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheLMODLkFYOa
• %System%\GroupPolicyMuvBIQUWNc
• %System%\GroupPolicyXZBptVwaxm
• %Program Files%\xoxWAJcuxIE\files\_locales\uk\messages.json
• %System%\GroupPolicynSDvJGcmYj
• %System%\GroupPolicykdfknkjzQj
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingscAQbkqOYkk
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachehaegaxrOYG
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMEUbQvzXqIS
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMuwsorTeuaa
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMfOKQXNPpdu
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsHAgZYsKxVY
• %System%\GroupPolicyajzjCKhlaV
• %System%\GroupPolicyOcgWwdJSZo
• %System%\GroupPolicyWXsSQNCJXe
• %Windows%\Tasks\pbmNgseZPebvewb.job
• %AppDataLocal%\Google\Chrome\User Data\SwReporterOPoCMWndiY
• %System%\GroupPolicyhNHkfMkqWu
• %System%\GroupPolicyjvBuQIGlqg
• %System%\GroupPolicyOKciLNRrhC
• %System%\GroupPolicyqvmjbolImG
• %Windows%\Temp\ifOKfREdsOIinPWn\QZsWbSnQYqGcBCvB.vbs
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachetGBmRfkpDI
• %System%\GroupPolicyCDxaMILrUJ
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsEqPNQhYWMO
• %System%\GroupPolicyizeDRpbMjT
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMBYxeYswSCv
• %System%\GroupPolicykofIVaOAAi
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheBFQkoyKRgX
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingswXTWHxmUpp
• %System%\GroupPolicyiFMQVrdTMR
• %System%\GroupPolicySNfoAEBxse
• %System%\GroupPolicypNNJPwfcre
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsTcyEXUrqix
• %System%\GroupPolicymeILLpBiUm
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsHlUkBxjYGS
• %System%\GroupPolicykyHiyRqFJg
• %AppDataLocal%\Google\Chrome\User Data\SwReporterifeGcLzcxk
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMjipCimCMsE
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMQirttEAwMt
• %AppDataLocal%\Google\Chrome\User Data\SwReporterTzRLEyflwY
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachetkymUUjveJ
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTAPOGSaTTs
• %System%\GroupPolicyejiMzyYAdn
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsTqwVoEryTG
• %System%\GroupPolicyhGXzLPvQRt
• %System%\GroupPolicynKNDNRkWpI
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheYWcTPNgzpf
• %System%\GroupPolicyWQJqGdAHZq
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingslEMOUpLcLR
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheJGjXFBxyuU
• %AppDataLocal%\Google\Chrome\User Data\SwReporterCcojVZIcvh
• %System%\GroupPolicyByphckrxPG
• %System%\GroupPolicyXwzYLJNVGJ
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheRhenfnWEhr
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheWTLItpizkQ
• %System%\GroupPolicydozGZyZWzC
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsCpXyXWqKqk
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMvSqlAfAOJP
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsMfoUlZtRbj
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMMSkXWnvEOx
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheTugcXuEMOC
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheKfBBVQipvr
• %System%\GroupPolicyCpyTByVjgn
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsgGbSUbSGMA
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheutYUJRmcdn
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMvTNIHoYvvo
• %System%\GroupPolicyDaDkaxubpJ
• %System%\GroupPolicyQxfQvNqsoz
• %Program Files%\xoxWAJcuxIE\files\_locales\en_US\messages.json
• %Program Files%\xoxWAJcuxIE\files\_locales\en\messages.json
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMfFCpvyqWzE
• %Program Files%\HIkkUNZSbbflerszmJR\dXhhfzy.dll
• %Program Files%\xoxWAJcuxIE\files\_locales\ar\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsVfggcGHOzg
• %System%\GroupPolicybveEXYqoQO
• %System%\GroupPolicynXLcYPROWp
• %System%\GroupPolicygHyhvzcVLW
• %System%\GroupPolicylSlACYJZnq
• %System%\GroupPolicyTNgdDETbiv
• %System%\GroupPolicyzjTsWaMfua
• %System%\GroupPolicywpZWCtBzjR
• %Program Files%\xoxWAJcuxIE\files\_locales\sk\messages.json
• %System%\GroupPolicymmsNuIaukB
• %System%\GroupPolicyGoSvJwRMER
• %System%\GroupPolicyxcXygDEEmO
• %System%\GroupPolicyrvAuNGukJh
• %System%\GroupPolicybfqEclbciS
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMmEgfyKxMaZ
• %System%\GroupPolicylBwXTUUYAJ
• %System%\GroupPolicyRUDkEwKHel
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsADGGAmuvbN
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachebMEkMewiOb
• %System%\GroupPolicywPGjzmWNXg
• %System%\GroupPolicyRkfWhPNtWI
• %System%\GroupPolicynYhTrBlSwL
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\prefs.js_tempEcveQn
• %System%\GroupPolicyiAFCYNERaE
• %System%\GroupPolicyWgTxmOyzAX
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMvDATjYhuZB
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheGbjLvAwrHy
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMgaRdsGwEle
• %Program Files%\xoxWAJcuxIE\files\_locales\lt\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheFbydblDgND
• %System%\GroupPolicyiPKRTcWapw
• %AppDataLocal%\Google\Chrome\User Data\SwReporterKNaDZihBnd
• %System%\GroupPolicyXCkgESLROd
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsCQYunOHQGN
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMSxaeBAPmln
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMMRRrEjxdxU
• %System%\GroupPolicyfslmCYuJRq
• %Program Files%\xoxWAJcuxIE\files\_locales\ta\messages.json
• %System%\GroupPolicylzAVdAlVEI
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMocLxyOfBhb
• %System%\GroupPolicyqFiDRtYjTl
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingswKnukCmawj
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheuhSDlITkHT
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachegbxUSirLKR
• %System%\GroupPolicyswFikwAKHe
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMVUaomOhIpJ
• %Program Files%\gvVbsKPBHESOC\xGVWjxs.xml
• %Program Files%\xoxWAJcuxIE\files\_locales\sq\messages.json
• %System%\GroupPolicyKcRaloPWKy
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingscXGilToRfA
• %AppDataLocal%\Google\Chrome\User Data\SwReporteruTtCdkDszT
• %System%\GroupPolicyYAwElOcLsd
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsjgGLETEPzQ
• %Program Files%\ckITvBKiU\aEDIXsR.xml
• %System%\GroupPolicymLTyqZOleE
• %System%\GroupPolicywIjHxjcEJR
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMqzybssmoro
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMhcMvZOzhGo
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingszlqvydWXzX
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheKYhXaFsybK
• %System%\GroupPolicyNTjuhEQzZA
• %System%\GroupPolicyqwgtnbpLKW
• %AppDataLocal%\Google\Chrome\User Data\SwReporterVKBwhCMKvW
• %System%\GroupPolicyDjdaXzJvcr
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMoiAfGRsZwq
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheBBDnDVrBGc
• %System%\GroupPolicywpvmnCnRcH
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacherjbzZwHAbt
• %Program Files%\xoxWAJcuxIE\files\_locales\ro\messages.json
• %Program Files%\xoxWAJcuxIE\files\_locales\th\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheXDqTwvYFKA
• %System%\GroupPolicyfjSuxrGYJF
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheaccSmpiNbz
• %AppDataLocal%\Google\Chrome\User Data\SwReporterqZiHjzIHYH
• %System%\GroupPolicyrUnkWgXpPV
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachemUyrnlaFzV
• %AppDataLocal%\Google\Chrome\User Data\SwReporterXEMLAPopxs
• %AppDataLocal%\Google\Chrome\User Data\SwReporterfsywSUhSBX
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsAcvDdrucWR
• %System%\GroupPolicysmzgGYCdbM
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachehzyHFWwJCg
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsVhodbhtfxA
• %System%\GroupPolicyYTHoKGnbFC
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachebIUwPnnmfj
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingswixGdpsBGv
• %AppDataLocal%\Google\Chrome\User Data\SwReporterEVImatJepo
• %System%\GroupPolicyIUBrxXvmeO
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachenXQmUbJuij
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsUOIJnuhgYj
• %AppDataLocal%\Google\Chrome\User Data\SwReporterxhsTjUFLqW
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsiNcUMyJFGg
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsqpLYdszQll
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMLqLQUgIThh
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMEXLaGiWDFf
• %System Root%\Program Files\Mozilla Firefox\browser\omni.ja.bak
• %System%\GroupPolicyfKWGUDxocn
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMObzhqftAri
• %System%\GroupPolicyxLQYILMdMz
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMeAYaoOdniC
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheMlkXfULZlU
• %System%\GroupPolicymePAqscdYe
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachecekvzTMaRa
• %AppDataLocal%\Google\Chrome\User Data\SwReporterIYVYdbcjfm
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMHMBZqiGTVw
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingstqUYzDIRAq
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachesCZGRvqgjI
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsGZjMuKDaUi
• %System%\GroupPolicysoVyIyEKoK
• %Program Files%\xoxWAJcuxIE\files\_locales\vi\messages.json
• %System%\GroupPolicyDKvRPgJxbZ
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-shm
• %AppDataLocal%\Google\Chrome\User Data\SwReporterCQWqIXEWNN
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsHwMUhjkFnB
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMTXoKPRRTCN
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheWhoAxMDICX
• %System%\GroupPolicyqQQuySgMDv
• %System%\GroupPolicyyRfcEUECVL
• %Program Files%\xoxWAJcuxIE\files\_locales\pt_PT\messages.json
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMClpYQuCzXb
• %System%\GroupPolicyQULTraTqXW
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachegvgayTNwyj
• %System%\GroupPolicyWuWMzWjXMb
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheDiKwpmiahh
• %System%\GroupPolicyfeJYJuBMci
• %System%\GroupPolicysFMeQpLFIv
• %AppDataLocal%\Google\Chrome\User Data\SwReporterFuwMAlqBMV
• %System%\GroupPolicyyPnWpCNFaJ
• %System%\GroupPolicywofcwQmhIu
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsOtmyNPULCI
• %Program Files%\ckITvBKiU\wECVfL.dll
• %System%\GroupPolicyjilCspIlBU
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMmSuILdfMbk
• %System%\GroupPolicyJryMdchNYV
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMcDxIhqVCfd
• %System%\GroupPolicyONLwWyWQFT
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheLgyqGUqHiG
• %System%\GroupPolicyaUZDoeMIwi
• %System%\GroupPolicyFNowJiTMVU
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMcuEbOFoTTY
• %System%\GroupPolicyVEATKPnKcY
• %AppDataLocal%\Google\Chrome\User Data\SwReporterLrmfVDxQKl
• %System%\GroupPolicyoiAaIunjbm
• %System%\GroupPolicyVatTMrGkHM
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachegfbFVLXMIo
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsyRGCuEiTyi
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsSkEhXWEoty
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachewDtQOeEbTz
• %System%\GroupPolicyvPgXoOOxom
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsbnZjTNIIfX
• %System%\GroupPolicyACjYgUFjgW
• %Program Files%\xoxWAJcuxIE\files\_locales\pl\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachefdEGMwJzPt
• %System%\GroupPolicypHUomrdZKC
• %System%\GroupPolicykIJdIdZLaK
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachedrWxsrIVzC
• %System%\GroupPolicylkWFnsuScQ
• %System%\GroupPolicyYSipDTbsDw
• %AppDataLocal%\Google\Chrome\User Data\SwReporterrqOhWvyvNb
• %System%\GroupPolicywcaIpSbyaR
• %System%\GroupPolicyHeRQqyrXUE
• %System%\GroupPolicyndEqcSSoxf
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMrntYLuAlAA
• %System%\GroupPolicyBYsbthVUVU
• %System%\GroupPolicyBqZZEmJCia
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheWwxwidVHZR
• %System%\GroupPolicyAGnItIVDSS
• %System%\GroupPolicyuKQgBIWbJs
• %Program Files%\gKYGDLlpJGpU2\VwQEnCwVQfVLY.dll
• %Program Files%\xoxWAJcuxIE\icon16.ico
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheJwkSadYRif
• %AppDataLocal%\Google\Chrome\User Data\SwReporterehVkpGtJWA
• %AppDataLocal%\Google\Chrome\User Data\SwReporterobKpVyHjCQ
• %AppDataLocal%\Google\Chrome\User Data\SwReportervCKxKxeWPV
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMxiEvhRgRkG
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMWZsSUAcpzb
• %System%\GroupPolicyJgwFHTpMct
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheIyJDnrrkal
• %AppDataLocal%\Google\Chrome\User Data\SwReporteryIQLnAwRgT
• %System%\GroupPolicyGXvjkyBdes
• %System%\GroupPolicyGhqLrFXUDA
• %System%\GroupPolicynJlaWRdjCT
• %System%\GroupPolicyTPOcthGBFY
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingshfbBoQADjJ
• %System Root%\Program Files\Mozilla Firefox\browser\omni.ja
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheAwGIcpjxrr
• %System%\GroupPolicyeKMuPNlohN
• %Program Files%\xoxWAJcuxIE\files\_locales\sv\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsKAkuoRDsNa
• %System%\GroupPolicyspqYzLhyVt
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMiirpMXSyOz
• %Program Files%\xoxWAJcuxIE\files\_locales\ko\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingspgGUHByrAu
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsPHmBnIquoX
• %System%\GroupPolicybKVAhmBEdo
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheBFbLgAJomT
• %AppDataLocal%\Google\Chrome\User Data\SwReporterFXlCubwAfo
• %Program Files%\xoxWAJcuxIE\files\_locales\fi\messages.json
• %AppDataLocal%\Google\Chrome\User Data\SwReporterwZLKisnjLe
• %AppDataLocal%\Google\Chrome\User Data\SwReporterkrvdYptzIw
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMtnqZmVrppx
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsWiLVciZiJA
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMnJyvpLZJzf
• %System%\GroupPolicyrNqkgFbkqa
• %AppDataLocal%\Google\Chrome\User Data\SwReporterIvcQLmcQMX
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMkhmWaREFAn
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMhNodDgijlg
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsaBfIMwmAdb
• %Program Files%\xoxWAJcuxIE\files\_locales\ca\messages.json
• %AppDataLocal%\Google\Chrome\User Data\SwReporterAFXbJqRSfQ
• %System%\GroupPolicySVqshauMzW
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsYGsgBmgfES
• %System%\GroupPolicydReTowgwCN
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheiQHLueJjQA
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheIqrBUrWmTs
• %System%\GroupPolicysSihumeTTt
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMIAtKDdGSRG
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\favicons.sqlite-wal
• %System%\GroupPolicyIAJdJLzxRG
• %System%\GroupPolicytJNdLCHeuO
• %System%\GroupPolicyoYvTFmHFAP
• %System%\GroupPolicylgtQoRjXcb
• %Program Files%\xoxWAJcuxIE\files\_locales\am\messages.json
• %AppDataLocal%\Google\Chrome\User Data\SwReportertVbULrlIeE
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsYhCRyjCLoc
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsUHCiJKKkHK
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsrMCEoBzztx
• %System%\GroupPolicyieThoApwmr
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-wal
• %System%\GroupPolicywdfjBogSZW
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMhqdcfQmEPz
• %System%\GroupPolicysChJDTkkfx
• %System%\GroupPolicyYTcdFbzvLa
• %System%\GroupPolicyJZGYKlgcOn
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachelvvJTOdplh
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMyzINTFZudy
• %System%\GroupPolicyfKjnvknEmt
• %System%\GroupPolicyZhZQCMpTQE
• %System%\GroupPolicyKlAvkrjSdD
• %AppDataLocal%\Google\Chrome\User Data\SwReporterrXJmKFBWpS
• %System%\GroupPolicyBsYSEiKFDR
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMAWcxTuTudM
• %System%\GroupPolicyCyDqBltcxn
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheGAIIyNoiQx
• %AppDataLocal%\Google\Chrome\User Data\SwReporterjyrYOfXySl
• %Program Files%\xoxWAJcuxIE\files\_locales\pt\messages.json
• %System%\GroupPolicyYNFSsjqXoh
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsYcnJpCezaO
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMaxDrFaMHSU
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsjhQpXCckqF
• %System%\GroupPolicyRDfkaxKDeD
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheAkuKnbZCJI
• %Program Files%\xoxWAJcuxIE\files\_locales\gu\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingswuQZbstsyY
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheFRgHcaYIdm
• %AppDataLocal%\Google\Chrome\User Data\SwReporterxEGwagkXLD
• %System%\GroupPolicyxgyScitjXk
• %System%\GroupPolicydUhpCIvdgY
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheJsxTlAPnjx
• %AppDataLocal%\Google\Chrome\User Data\SwReporterkfylTzFKOA
• %System%\GroupPolicyCJmKWwubnU
• %System%\GroupPolicyNKfZGIGWAU
• %System%\GroupPolicyfudmFCMBtN
• %Program Files%\xoxWAJcuxIE\files\_locales\cs\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsxHBlcXngnT
• %System%\GroupPolicyjiNsEckSer
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachegrbNeWZqlt
• %AppDataLocal%\Google\Chrome\User Data\SwReportercUtYHWHWhC
• %System%\GroupPolicyuniCqoDUUi
• %System%\GroupPolicysewMHlAbGl
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCachedlUokaVGOj
• %AppDataLocal%\Google\Chrome\User Data\SwReporterIptqAQCwGi
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsYjhJaSQhdn
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMxCkycspftk
• %User Temp%\nnDoSHYnMtCbSvqlq\FqZoviqRcarlObTMGTwdXzBLnB
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsHrpASgHUAA
• %AppDataLocal%\Google\Chrome\User Data\SwReporterUbQLcqIjFz
• %Program Files%\xoxWAJcuxIE\files\_locales\fr\messages.json
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsEXqOdCDDKj
• %System%\GroupPolicyKkoMdjZukV
• %AppDataLocal%\Google\Chrome\User Data\SwReporterOHCVsaOXjb
• %Program Files%\xoxWAJcuxIE\files\_locales\tr\messages.json
• %AppDataLocal%\Mozilla\Firefox\Profiles\lj5mikyj.default\startupCacheaPxxmtoiHy
• %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\saved-telemetry-pingsrVZizxWeke

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://www.{BLOCKED}date.info/updates/ya/ytab_m_43/win/version.txt?{random characters}
• http://www.{BLOCKED}date.info/updates/ya/ytab_m_43/win/update_e.jpg?{random characters}

This report is generated via an automated analysis system.