Exterminate It! Antimalware

malpedia

Known threats:700,086 Last Update:March 16, 12:51

Testimonials

Just want to say that apparently your Exterminate It has worked like a charm. I was infected with a most troublesome Malware Trojan that kept replicating every time McAfee found, blocked and removed it... most annoying for several days... until Mr. Google led me to your door. What a God send!

With thanks,

Tom S.

MultiPlug- Registry Values List

This is a complete list of MultiPlug registry values collected by Exterminate It!. If you find any of these registry values on your PC, your computer is very likely to be infected with the MultiPlug - adware.

IMPORTANT: Because the registry is a core component of your Windows system, it is strongly recommended that you back up the registry before you begin deleting keys and values. For information about backing up the Windows registry, refer to the Registry Editor online help.
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bogyjyqu]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns6EDF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pumuqylu]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns7EB2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servervo]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns6739.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sodurufo]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns9242.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wyriroso]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns1309.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zozygipy]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns4F28.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\meguqysy]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns5107.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sylixixu]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns3253.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vevisyde]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns350D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\DE8130F0-1488722106-5FBA-EF80-0026183959AE\qnsbCD8F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryveqopy]ImagePath=[%PROGRAM_FILES%]\32444335-1487951591-3735-5652-A0B3CC7FA549\znscDF0D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\32444335-1488423200-3735-5652-A0B3CC7FA549\qnsgE310.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zirudeho]ImagePath=[%APPDATA%]\2850BAC7-1430432609-CC5A-E0F5-1A0D96F33861\nslDC84.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\32354341-1439210037-3034-3132-354231314531\hnsz19F2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\BC06F680-1488450148-11DD-A92F-001FC6C8E845\qnswF8C2.tmp
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\edifying\azerbaijan.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\edifying\skittles.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zejytose]ImagePath=[%APPDATA%]\E9B76412-1436857756-E4E1-BE39-60A44C2BA0C1\jnsqE973.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pusyqyhi]ImagePath=[%PROGRAM_FILES%]\D6C23FE7-1479204738-11DC-BBDA-0B6A0A17001E\knsf609E.tmpfs
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto=notepad
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\domezeli]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1429376160-FFFF-FFFF-FFFFFFFFFFFF\cnstA5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gorikyzo]ImagePath=[%APPDATA%]\FFFFFFFF-1429368732-FFFF-FFFF-FFFFFFFFFFFF\jnse66.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gosesoky]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1429480110-FFFF-FFFF-FFFFFFFFFFFF\insh62.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gusenuzi]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1429376172-FFFF-FFFF-FFFFFFFFFFFF\snswAF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cunofozu]ImagePath=[%APPDATA%]\FFFFFFFF-1429368732-FFFF-FFFF-FFFFFFFFFFFF\nsc5B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cicifiso]ImagePath=[%APPDATA%]\80D67EFE-1424258618-DE11-850C-001DBAF7AF71\nsp7578.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\38464E43-1484872237-5633-4E31-001E68BA1C51\qnsnC458.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nomeryme]ImagePath=[%PROGRAM_FILES%]\F819587A-1481061439-D8E2-2321-B7FDB40DC2B7\knsa8668.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\teqypyfi]ImagePath=[%PROGRAM_FILES%]\A07DF677-1475912415-E111-9C47-00266C0710B5\knsaD9F9.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pisuboke]ImagePath=[%PROGRAM_FILES%]\33444335-1479392111-5035-3652-38EAA7EEA55C\knsCE26.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\2F9E3793-1466257472-DF11-B560-705AB65D3003\jnsoB5A8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\2F9E3793-1466257472-DF11-B560-705AB65D3003\hnsoCC84.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A57EA8E4-1487518990-CE04-DEFC-2C27D7B4BE27\qnsjBDC7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\boxexycu]ImagePath=[%PROGRAM_FILES%]\8BC83000-1483200162-11E0-0000-3CD92B59C492\kns710C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nogyliki]ImagePath=[%PROGRAM_FILES%]\8BC83000-1481229604-11E0-0000-3CD92B59C492\knsD605.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\670864FF-1460581689-11E3-A300-2286570180FF\hnsl7683.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\9014E658-1487410104-E511-90AB-DC4A3E176FF3\qnssF770.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\33444335-1460419248-4236-4C51-A0481C0F768A\hnslD6CD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\33444335-1460419248-4236-4C51-A0481C0F768A\jnssA7CC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\33444335-1462975137-4236-4C51-A0481C0F768A\qnsm2C16.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1472134070-5A10-804B-B5C04F353432\jnsb513B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1472134070-5A10-804B-B5C04F353432\hnsl6F08.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1485987410-FFFF-FFFF-FFFFFFFFFFFF\qnspA837.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\41313030-1452807705-4639-3438-45464D9F48EF\jnsk190C.tmp
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\victuals\mcdowall.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\victuals\afterthoughts.exe"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto="[%PROGRAM_FILES%]\victuals\mcdowall.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1487286084-0500-0006-000700080009\qnsx17D7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\03000200-1461427730-0500-0006-000700080009\hnsx7C53.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tetobepu]ImagePath=[%PROGRAM_FILES%]\927F0C84-1459453681-E511-8273-54EE75659024\kns52E5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zizusyju]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1449803435-3510-804E-B7C04F5A3032\hnsx35C2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\42B776BE-1487095760-DD11-BA86-001EEC98EB22\qnsn5415.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\34444335-1487085372-4730-5143-6CC21771B2F0\qnse3552.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\focohyzo]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1473535637-4D10-804E-B8C04F545031\knsnCEAA.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xunuloci]ImagePath=[%PROGRAM_FILES%]\BB1F9B01-1445561102-E111-8066-DC0EA1E304B9\knssD827.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4085019B-1485439004-E111-A569-A18099770A04\qnsd6D55.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gosulyri]ImagePath=[%PROGRAM_FILES%]\25A4EDED-1481817057-ADCA-CB81-086266A44A59\knso3ED0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zifyveso]ImagePath=[%PROGRAM_FILES%]\00000000-1440531265-0000-0000-6C626D426354\knss2277.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nevinyqu]ImagePath=[%APPDATA%]\41EA14D1-1432636862-11E0-B16A-41027F19F07A\jnsp2058.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\FEFC32A0-1455771459-11D5-9B38-3085A9918D2E\hnshB32D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\FEFC32A0-1455771459-11D5-9B38-3085A9918D2E\jnsh8883.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486582537-3510-8032-B7C04F525A31\qnsc1F9C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryveqopy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1486569038-5110-8048-B7C04F303632\znsu5E29.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\9FA96E40-1460015672-11E1-AE21-386077B048F3\hnsfDA51.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\9FA96E40-1460015672-11E1-AE21-386077B048F3\jnsvBBE7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tyqigivu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482908953-3310-8032-B1C04F37334A\kns42FA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1486585615-0000-0000-D43D7EF12A58\qnssFF84.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pevicyne]ImagePath=[%PROGRAM_FILES%]\03000200-1469020179-0500-0006-000700080009\kns9732.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\durowigy]ImagePath=[%LOCAL_APPDATA%]\34444335-1428480979-4738-4B53-A01D48E4EDB2\inst966.tmp
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\laporte\bean.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1486430262-0500-0006-000700080009\qnsy8FB8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1486372475-0000-0000-6C626D42D82A\qnskAD9E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopuruko]ImagePath=[%PROGRAM_FILES%]\38464E43-1475689721-3434-5953-001E684802A9\knsqBB47.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486240158-3510-8032-B7C04F525A31\qnswD268.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486228786-3510-8032-B7C04F525A31\qnsw4ADE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486169088-3510-8032-B7C04F525A31\qnsoA30E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\031B021C-1486210252-0518-E906-470700080009\qnsc2C6C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486160640-3510-8032-B7C04F525A31\qnsxBC37.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486146283-3510-8032-B7C04F525A31\qnsjA8F1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\A1847F88-1462420631-11E2-B0DE-001267018052\hnsyD37A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\A1847F88-1462420631-11E2-B0DE-001267018052\jnsoB3D8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\90668C23-1486068337-DF11-B59F-00266C80DEBC\qnsxC74D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fipufuwu]ImagePath=[%PROGRAM_FILES%]\03000200-1446790045-0500-0006-000700080009\hnskBB93.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\segudecy]ImagePath=[%PROGRAM_FILES%]\03000200-1446790045-0500-0006-000700080009\knse8917.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\betebegi]ImagePath=[%PROGRAM_FILES%]\C3A87598-1479985085-71C1-9A5B-C4346B498974\knsi9EC5.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\C3A87598-1471953883-71C1-9A5B-C4346B498974\jnsw76EA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hiduxixi]ImagePath=[%PROGRAM_FILES%]\C3A87598-1479896765-71C1-9A5B-C4346B498974\knsjC9C0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kefowydy]ImagePath=[%PROGRAM_FILES%]\C3A87598-1440135806-71C1-9A5B-C4346B498974\hnsh6200.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\C3A87598-1471953883-71C1-9A5B-C4346B498974\hnsrA8AA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xytekyby]ImagePath=[%PROGRAM_FILES%]\C3A87598-1474112041-71C1-9A5B-C4346B498974\knsnF283.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zybosode]ImagePath=[%PROGRAM_FILES%]\C3A87598-1473297258-71C1-9A5B-C4346B498974\knsdDD9C.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\betibihu]ImagePath=[%PROGRAM_FILES%]\C3A87598-1482146185-71C1-9A5B-C4346B498974\kns381D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gefimutu]ImagePath=[%PROGRAM_FILES%]\C3A87598-1481777457-71C1-9A5B-C4346B498974\knseD5E.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hygudivo]ImagePath=[%PROGRAM_FILES%]\C3A87598-1482557002-71C1-9A5B-C4346B498974\kns5CA1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\konecyve]ImagePath=[%PROGRAM_FILES%]\C3A87598-1481558190-71C1-9A5B-C4346B498974\knsrED7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xyrugipu]ImagePath=[%PROGRAM_FILES%]\C3A87598-1480711113-71C1-9A5B-C4346B498974\kns12EA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\84E64EAC-1485660417-11E1-9658-08107F19C081\qnsb8299.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\856444A0-1469119097-11D5-876C-00221556F4CF\jnsu2E2E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\856444A0-1469119097-11D5-876C-00221556F4CF\hnsy4590.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rucewety]ImagePath=[%PROGRAM_FILES%]\CF4D26DD-1476707976-9447-D520-E03F49519A4B\knsk6E25.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\CF4D26DD-1476727870-9447-D520-E03F49519A4B\qnsqD73E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\131B9781-1485861413-11CB-B480-922D0E9D421B\qnso1C2C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tetumupo]ImagePath=[%PROGRAM_FILES%]\131B9781-1478329239-11CB-B480-922D0E9D421B\kns8AB0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1485793764-0000-0000-001FD0166430\qnsz737F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1485779635-4710-8034-B4C04F515231\qnsh95BD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1485718666-4310-8047-B3C04F353832\qnsc578.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\CB443043-1485719470-EF3E-EECB-089E01D06A91\qnsiB560.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\D789F481-1475086043-11CB-8ED3-CC054FFD475D\qnswFC6A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tulomyfe]ImagePath=[%PROGRAM_FILES%]\D789F481-1474827062-11CB-8ED3-CC054FFD475D\kns2C9D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\7B65235B-1485575956-11E4-A961-68F728AB3B12\qnsp3B77.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A00D6937-1485405008-5FE7-B8D6-B60B6B0CFD29\qnsx1AE7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\guvuqigy]ImagePath=[%PROGRAM_FILES%]\809326F6-1477905972-E111-81CA-D48AF65C1965\kns9DAD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1461498152-11DD-1690-669910425D29\hnsh1779.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1461498152-11DD-1690-669910425D29\jnsr4CC9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1451382940-11DD-1690-669910425D29\hnsk6300.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1DEBA753-1468267151-11DD-1690-669910425D29\qnsbA2F7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1451382940-11DD-1690-669910425D29\jnsp303B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\09B9724C-1469385181-1220-0705-014148000000\jnseE5CE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\09B9724C-1469385181-1220-0705-014148000000\hnse1A86.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\09B9724C-1470414206-1220-0705-014148000000\qnsc55A0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wyqonese]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482736520-3010-8030-B0C04F303030\knsn4CCD.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1485138997-5310-8054-B3C04F483532\qnsoB61C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zyqejiky]ImagePath=[%APPDATA%]\28969F34-1423913473-11DE-BBDA-05EF7BE718A9\nsy3EE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\038D0240-1485471558-053B-3A06-EE0700080009\qnsw5514.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\486F36D1-1484323366-E311-A37A-201A069F5271\qnsw60BE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\peziqewu]ImagePath=[%PROGRAM_FILES%]\03000200-1451078112-0500-0006-000700080009\knszC22B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rizyqibe]ImagePath=[%PROGRAM_FILES%]\03000200-1451078112-0500-0006-000700080009\jnsyB27E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vyvyzoti]ImagePath=[%PROGRAM_FILES%]\03000200-1451501800-0500-0006-000700080009\knsn7B2D.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\03000200-1453100357-0500-0006-000700080009\hnsw48DC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zizusyju]ImagePath=[%PROGRAM_FILES%]\03000200-1451078112-0500-0006-000700080009\hnsoF3DE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\03000200-1451501800-0500-0006-000700080009\jnsqA938.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cydunozy]ImagePath=[%PROGRAM_FILES%]\3CD1D54B-1481721431-E04B-ABBA-047D7BD1DD03\knsfFBD3.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\3CD1D54B-1485306638-E04B-ABBA-047D7BD1DD03\qnss1048.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vynutuci]ImagePath=[%PROGRAM_FILES%]\80211A9A-1469890482-4437-9A4A-82DAEB3F378E\kns12C5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\7A437281-1462993938-11CB-B970-C091C4FF7457\qnsoDCAA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\43B4F040-1485212588-11D5-8E3C-1C872CC59257\qnsq683C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fizovicy]ImagePath=[%PROGRAM_FILES%]\00000011-1480218599-0000-0000-E03F49BF21BC\kns894A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000011-1483035492-0000-0000-E03F49BF21BC\qnso380.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\duwuteby]ImagePath=[%PROGRAM_FILES%]\80211A9A-1469890482-4437-9A4A-82DAEB3F378E\knsDC75.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\03000200-1463621310-0500-0006-000700080009\jnsf313D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\03000200-1463621310-0500-0006-000700080009\hnsv4DA5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\FE0EA01F-1485141114-7859-3C30-A1FEEB12FE8D\qnsu72B4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\94F7E546-1460269692-7348-823A-92DCE3B5E71C\hnsvA56B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\94F7E546-1460269692-7348-823A-92DCE3B5E71C\jnss4680.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dovufosy]ImagePath=[%PROGRAM_FILES%]\69C4405D-1478848998-E311-A34E-208984FEE8BB\knsnFE26.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\C014B4DC-1485097738-E411-85C7-F0761C735C8F\qnspD117.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\E4643100-1468656578-81E1-38D8-5404A64C5CA5\qnsc5810.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1485106656-0000-0000-001FD0166430\qnsmCA64.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\139F7C00-1485110206-81E2-38D8-50465DE8ACF3\qnsk9BD8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\2237D745-1484833857-11DF-B7D7-8080470340F4\qnsl17CD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\DE7F63F5-1484953410-11E4-A818-28D244E877A5\qnsn4B99.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1F459200-1484987069-81DF-3313-BCAEC5123316\qnsp7F8D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fedytuni]ImagePath=[%PROGRAM_FILES%]\34363965-1480158142-3536-3036-705AB6F3CF2B\knsoA993.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucihivu]ImagePath=[%PROGRAM_FILES%]\67112500-1450165936-0920-1212-031204000000\knsa2907.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\9CB2482B-1466556356-11DE-BBD8-7D531FB30023\jnsxA4CD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\9CB2482B-1466556356-11DE-BBD8-7D531FB30023\hnskC3A2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\piroxine]ImagePath=[%PROGRAM_FILES%]\9CB2482B-1482081979-11DE-BBD8-7D531FB30023\knsAE96.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\6A9269F1-1484908531-694E-9556-0C5223EA5FA1\qnsa80FE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ponuqesu]ImagePath=[%PROGRAM_FILES%]\03DE0294-1482585690-05DC-0A06-670700080009\knsFEEF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jozyzoli]ImagePath=[%PROGRAM_FILES%]\E7A80380-1473770124-81E1-3393-3085A9185DC9\kns9A80.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\AAAAAAAA-1484657159-AAAA-AAAA-D43D7EE0D2C7\qnsu1D4C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dyqimyje]ImagePath=[%PROGRAM_FILES%]\07E63B5B-1481998796-11DF-BB29-1C81B300405A\knso6E20.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1471371893-5710-8042-B4C04F525831\hnsq148C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jucosuwe]ImagePath=[%PROGRAM_FILES%]\03000200-1480402757-0500-0006-000700080009\knsk5BD7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1480428074-0500-0006-000700080009\qnse602E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jedufuqu]ImagePath=[%PROGRAM_FILES%]\5BEF89E8-1480744700-11E0-9F61-4145CC962C1F\knss520A.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jihexyke]ImagePath=[%PROGRAM_FILES%]\5BEF89E8-1480866830-11E0-9F61-4145CC962C1F\knsF7A9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\votyhose]ImagePath=[%PROGRAM_FILES%]\5BEF89E8-1480751237-11E0-9F61-4145CC962C1F\knsD2DA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\EED08878-1484058831-1E40-B502-047D7B1DB3BC\qnsa8FA2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gohorogu]ImagePath=[%PROGRAM_FILES%]\BFA5AA49-1477661375-B16D-0772-D02788B39074\knsr75A2.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gymoleko]ImagePath=[%PROGRAM_FILES%]\B0156226-1481880498-E211-8E5B-6C3BE59053B0\knsj5E21.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\motukily]ImagePath=[%PROGRAM_FILES%]\13B45D78-1475321382-9F4E-D6EB-54A050E83576\knsvE861.tmpfs
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Commonplace\parham.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\nannies\dismissals.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Commonplace\parham.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\nannies\croats.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\debipere]ImagePath=[%PROGRAM_FILES%]\77164D14-1480504751-11DC-BBDA-C4F2DCB6001C\knsmAFE7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gekohoru]ImagePath=[%PROGRAM_FILES%]\A8D414A5-1482000323-E211-A25E-B888E3B9A28D\knsE1AE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lomuposo]ImagePath=[%PROGRAM_FILES%]\C45A7700-1475458828-944B-8C15-089E013FBD73\knscF683.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\digisudo]ImagePath=[%PROGRAM_FILES%]\01321DD1-1449172578-CB11-A44F-A58D2F67C0AD\hnsoCF33.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fulewedu]ImagePath=[%PROGRAM_FILES%]\01321DD1-1449172578-CB11-A44F-A58D2F67C0AD\jnsoB8A5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\povopilu]ImagePath=[%LOCAL_APPDATA%]\01321DD1-1449179832-CB11-A44F-A58D2F67C0AD\snst6441.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wisukecy]ImagePath=[%PROGRAM_FILES%]\01321DD1-1449172578-CB11-A44F-A58D2F67C0AD\knsqC0D1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fikidihu]ImagePath=[%PROGRAM_FILES%]\672FC64F-1479687954-E111-B40E-B888E3636561\kns5194.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lucibity]ImagePath=[%PROGRAM_FILES%]\672FC64F-1479687954-E111-B40E-B888E3636561\kns9E6A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\F280D780-1470453634-11E2-878C-089E015C9BBD\jnsgF556.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fyxityro]ImagePath=[%PROGRAM_FILES%]\F280D780-1470453634-11E2-878C-089E015C9BBD\knsp121F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\F280D780-1470453634-11E2-878C-089E015C9BBD\hnsh3075.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\2197C180-1437049191-11B2-8000-DBE4622636D8\snsrAAA3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1483999649-5310-8047-C3C04F383132\qnswB68.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1484295263-4E10-8059-B1C04F483132\qnsiA2DC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\23FC9A40-1459687978-11DD-9AEA-305A3ADF9C6B\hnsrDD65.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\23FC9A40-1459687978-11DD-9AEA-305A3ADF9C6B\jnsrC5ED.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1484270986-4210-8046-CAC04F5A334A\qnss5CC2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\6EACFFC0-1484230934-E411-85C7-F0761C8571B9\qnslABAB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\038D0240-1483788481-055B-4C06-560700080009\qnsrA6FB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\B7203793-1484172465-E211-A324-208984E59796\qnsi8A52.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bodocifu]ImagePath=[%APPDATA%]\00000000-1430148426-0000-0000-448A5BA6F296\jnsaB115.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nuxodiru]ImagePath=[%APPDATA%]\00000000-1430148426-0000-0000-448A5BA6F296\nsf59BC.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\BBF80539-1482373399-974E-8A26-4EC73AD130AC\qnszA40F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rudymexe]ImagePath=[%PROGRAM_FILES%]\03AA02FC-1453170990-05E5-3906-140700080009\knsED2D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fisojoji]ImagePath=[%PROGRAM_FILES%]\EE1A6E3B-1476368883-3945-2BAD-7B80C6ABF857\kns1C3C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zyryceji]ImagePath=[%PROGRAM_FILES%]\EE1A6E3B-1476368883-3945-2BAD-7B80C6ABF857\kns5C44.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dumedope]ImagePath=[%PROGRAM_FILES%]\EE1A6E3B-1476368883-3945-2BAD-7B80C6ABF857\kns56.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\ECF59000-1484056847-0000-0000-000000000000\qnsw2292.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\20F42F65-1484100970-E211-A322-208984E09540\qnsv9EC9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%SYSTEMX86%]\config\systemprofile\AppData\Local\8F655F20-1483912493-11DD-944E-60A44C25973C\qnshE1B5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\F8FA4F29-1483940915-FF4C-83DD-1F28BEB3EB56\qnshC345.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\meguqysy]ImagePath=[%PROGRAM_FILES%]\21B404EC-1478188445-E511-A26A-308D9977082B\knsf8762.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyhiryto]ImagePath=[%PROGRAM_FILES%]\33444335-1482154886-5330-3754-A45D367BF5D6\knsnF7ED.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1483885263-0500-0006-000700080009\qnsj25C5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tebyqigu]ImagePath=[%PROGRAM_FILES%]\03000200-1482914325-0500-0006-000700080009\kns27EE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\0A36E040-1483722024-11DB-A715-001BFCB14C99\qnsq4616.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1483795107-0500-0006-000700080009\qnsc34B8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\solywucy]ImagePath=[%PROGRAM_FILES%]\03000200-1482108263-0500-0006-000700080009\kns3FB0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\EF06F480-1483752370-1012-9C4F-99EBABAAB803\qnspDC3D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\covoqujo]ImagePath=[%PROGRAM_FILES%]\E8FC6300-1482556514-11E3-A21B-C03FD5650B96\knseB9E2.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roboqego]ImagePath=[%PROGRAM_FILES%]\DC8125E5-1483751098-572C-1C80-001E8CE97FA5\znsx4280.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rowugoqo]ImagePath=[%LOCAL_APPDATA%]\3FE91380-1457959438-5874-97B0-305A3A0EC47B\snseE6EC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\3FE91380-1457933865-5874-97B0-305A3A0EC47B\hnsm2514.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\boxexycu]ImagePath=[%PROGRAM_FILES%]\91521A60-1483414462-11E1-87AD-20A0651475BF\knse3B22.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\91521A60-1483725034-11E1-87AD-20A0651475BF\qnsw55FE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000011-1483610370-0000-0000-50465D9B6A9E\qnsiAFFE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\70757DCE-1472533451-36F0-9AD0-F079595AC1B9\jnse205B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\70757DCE-1472533451-36F0-9AD0-F079595AC1B9\hnss4E04.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\CA6CBF51-1478091789-11E4-A26A-F0761C698918\qnsi4CB2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jymibike]ImagePath=[%PROGRAM_FILES%]\CA6CBF51-1477509259-11E4-A26A-F0761C698918\kns9227.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cyfemeze]ImagePath=[%PROGRAM_FILES%]\543C9E1A-1476190074-11E3-B767-A088BF0C60DA\kns5F2A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1483563141-0500-0006-000700080009\qnsq25A4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\15AFCA0D-1483558903-E311-B064-F8A963716139\qnsr48AB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hepiwope]ImagePath=[%PROGRAM_FILES%]\00000000-1483351463-0000-0000-1C6F65E1FA89\knsgEFD0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\03000200-1437981140-0500-0006-000700080009\hnsn2014.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\03000200-1438000993-0500-0006-000700080009\snsk97F4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wunizyko]ImagePath=[%PROGRAM_FILES%]\03000200-1437981140-0500-0006-000700080009\knss4F65.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\03000200-1437981140-0500-0006-000700080009\jnsv1BC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tocyfori]ImagePath=[%PROGRAM_FILES%]\CC29F313-1483436008-11DF-8B22-6EC0590080CF\knsD49E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\611931A1-1483387304-A845-8550-49F86AEDACEA\qnsc4134.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nyqigopo]ImagePath=[%PROGRAM_FILES%]\8FCC2DCC-1483368148-11E6-8D30-5C2C09521C00\knsrBEE7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lukibicy]ImagePath=[%PROGRAM_FILES%]\34444335-1483347313-4C34-4458-6CC217789594\kns93CC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wesewozo]ImagePath=[%PROGRAM_FILES%]\34444335-1483347313-4C34-4458-6CC217789594\kns59C5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zoribuni]ImagePath=[%PROGRAM_FILES%]\31A0F328-1481350852-1015-8CA1-71C0FE7BE7D4\kns9F27.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1472595375-4710-8050-B7C04F5A4E31\jnsg7563.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1472595375-4710-8050-B7C04F5A4E31\hnsv8E89.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jopesucu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1474754285-4710-8050-B7C04F5A4E31\kns79A8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\myfejozi]ImagePath=[%PROGRAM_FILES%]\D87F6850-1447869919-11E2-AFF6-3C077165FEE2\jnsqCA9A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sikyheko]ImagePath=[%PROGRAM_FILES%]\D87F6850-1483141712-11E2-AFF6-3C077165FEE2\kns6A77.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\boxexycu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1483421011-4310-8043-B7C04F574E31\knsv8B17.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\guwulutu]ImagePath=[%PROGRAM_FILES%]\36367E75-1482572464-11E5-8B16-F0761CF1480E\kns3EBC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\josojosi]ImagePath=[%PROGRAM_FILES%]\42314331-1483401028-3134-3935-4134FFFFFFFF\knsvF421.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dipubibu]ImagePath=[%LOCAL_APPDATA%]\03000200-1443964900-0500-0006-000700080009\snsi3332.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gimydydi]ImagePath=[%PROGRAM_FILES%]\03000200-1443936052-0500-0006-000700080009\knsd8B39.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gyvixodu]ImagePath=[%PROGRAM_FILES%]\03000200-1443936052-0500-0006-000700080009\hnsnC69B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lehicewu]ImagePath=[%PROGRAM_FILES%]\03000200-1443936052-0500-0006-000700080009\jnssADBC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gykyxilo]ImagePath=[%PROGRAM_FILES%]\B0227647-1482333534-DF11-BBA9-00266C47490F\knsf873D.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\B0227647-1483400710-DF11-BBA9-00266C47490F\qnsgAAC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\buwomyre]ImagePath=[%APPDATA%]\F5ECD029-1431523245-E311-83BA-201A06DE3AD9\jnsc75ED.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nykelozy]ImagePath=[%LOCAL_APPDATA%]\F5ECD029-1431530789-E311-83BA-201A06DE3AD9\snsh1345.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\F5ECD029-1455928891-E311-83BA-201A06DE3AD9\qnsxB09B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\03000200-1469085067-0500-0006-000700080009\hnsm29C4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\03000200-1469085067-0500-0006-000700080009\jnsgCD4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\busynecu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1483346018-3910-804A-B6C04F583532\kns6926.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\goculofe]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1483357831-4410-8050-C7C04F595031\kns495F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\risebice]ImagePath=[%PROGRAM_FILES%]\00000000-1483315913-0000-0000-D43D7EE2612D\kns474C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pehujiti]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1478423452-5710-8051-B6C04F424232\knsi220F.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qowiluze]ImagePath=[%PROGRAM_FILES%]\31444335-1483112485-3533-3251-441EA1DA0AE1\knsvEB33.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\03000200-1472490777-0500-0006-000700080009\jnsg317E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\03000200-1472490777-0500-0006-000700080009\hnsr4E14.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roduwuqi]ImagePath=[%PROGRAM_FILES%]\03000200-1472490777-0500-0006-000700080009\kns54E5.tmp
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto="[%PROGRAM_FILES%]\ghat\archaeological.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\coqicuvo]ImagePath=[%PROGRAM_FILES%]\C693E624-1483174309-11E2-AC0B-44E22C000030\knsj36DF.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jesogenu]ImagePath=[%PROGRAM_FILES%]\30BD3360-1482555151-11E1-883C-78843CF84BF8\knsnB2F.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fozewehe]ImagePath=[%PROGRAM_FILES%]\31A0F328-1481350852-1015-8CA1-71C0FE7BE7D4\kns9D86.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\borikyho]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1481437530-3410-8038-C2C04F564232\kns7F1C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hynyruqe]ImagePath=[%PROGRAM_FILES%]\4E435451-1483119406-3034-4532-50465D3E203E\knsF886.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dipubibu]ImagePath=[%LOCAL_APPDATA%]\40CAD771-1444828151-E111-9F0D-97E6C9DC269B\snsl32D3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijifivo]ImagePath=[%PROGRAM_FILES%]\40CAD771-1444802844-E111-9F0D-97E6C9DC269B\knskD512.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tikonitu]ImagePath=[%PROGRAM_FILES%]\D32B8702-1454065368-E111-AC78-DC0EA1B646D3\kns21AE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\D32B8702-1483109554-E111-AC78-DC0EA1B646D3\qnskB84.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bifoqixy]ImagePath=[%PROGRAM_FILES%]\E8251C00-1483073806-0820-0603-181459000000\knsz2DD9.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\E8251C00-1483093755-0820-0603-181459000000\qnsg6A68.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tygijufi]ImagePath=[%PROGRAM_FILES%]\E8251C00-1480757562-0820-0603-181459000000\kns3181.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1483118355-0500-0006-000700080009\qnsm2454.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hikikohu]ImagePath=[%PROGRAM_FILES%]\03000200-1483041456-0500-0006-000700080009\knsE33B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\viqysuho]ImagePath=[%PROGRAM_FILES%]\1E008F60-1450891218-D600-4FB1-485B395F04DB\knsy5324.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qimucexi]ImagePath=[%PROGRAM_FILES%]\FB4A0853-1482139017-11DE-A04F-20C9083990D3\kns51A3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fopimufo]ImagePath=[%PROGRAM_FILES%]\B4636ADE-1482966508-11E2-85CA-C537CAA01E00\knsaA328.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\B4636ADE-1483114677-11E2-85CA-C537CAA01E00\qnsw173A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bicibehy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482925158-3910-8043-C2C04F365131\kns4184.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\31444A20-1466446170-11B2-8000-80EB99C00C30\hnsb7235.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fewyxygo]ImagePath=[%PROGRAM_FILES%]\1CDAC2FA-1482953157-4649-ABE3-864F5CBE70D9\knsD433.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\5151970A-1463694324-11E4-B57F-68F7281ECF58\jnsu86D4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\5151970A-1463694324-11E4-B57F-68F7281ECF58\hnsfA1B1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jusyvypo]ImagePath=[%PROGRAM_FILES%]\00000000-1482894827-0000-0000-002421B9DF08\kns32EF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tejygoky]ImagePath=[%PROGRAM_FILES%]\03000200-1475743812-0500-0006-000700080009\kns3D4F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\celohoky]ImagePath=[%PROGRAM_FILES%]\96C00055-1483003923-8645-B6DC-889EE6AC1464\knsyAE20.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\832FD6BD-1468781860-E111-8512-B888E352A789\jnsyE6B6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dojygici]ImagePath=[%PROGRAM_FILES%]\03AA02FC-1457631702-057F-F706-9D0700080009\jnsl6545.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\03AA02FC-1457631702-057F-F706-9D0700080009\hnst85CF.tmp
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\unstuck\ipanema.exe"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto="[%PROGRAM_FILES%]\unstuck\ipanema.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ticepivo]ImagePath=[%PROGRAM_FILES%]\2AECEF80-1482993297-11DF-AEAA-D31E727A5A33\knsyE3EE.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\2AECEF80-1483023656-11DF-AEAA-D31E727A5A33\qnsrDA1B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\woziriqy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1481219607-3310-8035-B1C04F475731\knsd9CFB.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cyzuboru]ImagePath=[%PROGRAM_FILES%]\18EA9736-1482950692-11E6-8EC0-EC4E17C13201\knstFF39.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kicibesu]ImagePath=[%PROGRAM_FILES%]\00000000-1482894827-0000-0000-002421B9DF08\knsy40F4.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dynynihi]ImagePath=[%PROGRAM_FILES%]\2F9C1100-1482885899-11DD-8675-74D02B36821E\kns45A0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hifutujo]ImagePath=[%PROGRAM_FILES%]\1F004F40-1482884155-0A00-A6D0-BCAEC5445A0A\knsf9DBF.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\robynure]ImagePath=[%PROGRAM_FILES%]\336CB580-1481530776-4248-482C-22510A9209D0\knsbB3FD.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xumenicy]ImagePath=[%PROGRAM_FILES%]\FFFFFFFF-1479313074-FFFF-FFFF-FFFFFFFFFFFF\knsd5CAE.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bucicymi]ImagePath=[%PROGRAM_FILES%]\7C6E0305-1482943030-4446-9AB4-A47D6C9315D9\knsb87AF.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\7C6E0305-1482943123-4446-9AB4-A47D6C9315D9\qnsg1EE6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1478697178-4310-8053-B8C04F4C5431\qnsw2ABC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rizusone]ImagePath=[%PROGRAM_FILES%]\1B357A81-1482418776-11E1-BC4B-DDEB060BF75E\kns1F83.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fefefigu]ImagePath=[%PROGRAM_FILES%]\30A483E6-1478277000-E211-9AB1-008CFA2ABDDC\knsl456E.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roviveku]ImagePath=[%PROGRAM_FILES%]\22A74000-1482779884-0000-0000-000000000000\knsp8099.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\toriqulo]ImagePath=[%PROGRAM_FILES%]\12345678-1482818088-5678-90AB-CDDEEFAABBCC\knso9302.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\12345678-1482843362-5678-90AB-CDDEEFAABBCC\qnseB646.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sylekovi]ImagePath=[%PROGRAM_FILES%]\00000000-1482574634-0000-0000-1C6F65EEE8B0\knsE7A2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xopoloxy]ImagePath=[%PROGRAM_FILES%]\28B4B287-1482698049-11DE-B787-5D136A79F2E3\knsF539.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1471703485-4E10-804E-C2C04F443032\jnsd54F2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1471703485-4E10-804E-C2C04F443032\hnsu7F10.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1482486361-4E10-804E-C2C04F443032\qnst687B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cuwyginy]ImagePath=[%PROGRAM_FILES%]\7BD648C0-1482407198-11D5-8657-5404A69B344C\knsA512.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nycyhywe]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482606653-4310-8059-B4C04F515831\knsdE6BE.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1482607499-4310-8059-B4C04F515831\qnsm2312.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rucudohe]ImagePath=[%PROGRAM_FILES%]\3B254A80-1482075771-81E0-3797-14DAE9D04BA9\kns502E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wizuqoco]ImagePath=[%PROGRAM_FILES%]\00000000-1481901494-0000-0000-000000000000\kns1852.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fobytosy]ImagePath=[%PROGRAM_FILES%]\7DDA4760-1482596146-11DD-96F7-305A3A47CD82\kns5A6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\syhenily]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482373002-4E10-804E-C7C04F513232\knsa9A3A.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dozozomo]ImagePath=[%PROGRAM_FILES%]\8801D31C-1476108041-11DD-1E8C-6D990E2C5D29\kns10B2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\1CDA11A0-1437716840-11D9-8364-F46D04665F11\hnseE409.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kuquhuce]ImagePath=[%PROGRAM_FILES%]\D31D3C20-1482568709-11E0-86AA-BCAEC54EAACC\knsxFE37.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hoxokusu]ImagePath=[%PROGRAM_FILES%]\031B021C-1482366702-0537-8F06-2E0700080009\knsu3BD8.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\myvibode]ImagePath=[%PROGRAM_FILES%]\6816B0BE-1482580906-4E58-8067-8C340CB13AA3\knsi7694.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gerobyke]ImagePath=[%PROGRAM_FILES%]\EA9FFF23-1482575900-AE02-9375-F832E4CC964C\knsd4091.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jetudosu]ImagePath=[%PROGRAM_FILES%]\03000200-1482445064-0500-0006-000700080009\knsvA5AE.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ridipere]ImagePath=[%PROGRAM_FILES%]\03000200-1482235124-0500-0006-000700080009\knszE51F.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xuqyviqo]ImagePath=[%PROGRAM_FILES%]\D2DB4AA8-1482469597-E011-890E-505054503030\knsr7719.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\D2DB4AA8-1482493026-E011-890E-505054503030\qnssCEF4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tudetire]ImagePath=[%PROGRAM_FILES%]\04048707-1477272685-DF11-AC18-8C736EA3806B\kns75F6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wywymeqo]ImagePath=[%PROGRAM_FILES%]\04048707-1477272685-DF11-AC18-8C736EA3806B\kns58E7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qibipyku]ImagePath=[%PROGRAM_FILES%]\F523F1E0-1482172876-11D5-9C0C-90E6BAC14979\kns10B4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\letuhuko]ImagePath=[%PROGRAM_FILES%]\A8DB46BD-1482080194-11E2-9742-69C45F060069\knst63E9.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bufykiwi]ImagePath=[%PROGRAM_FILES%]\E84AF480-1440270954-11E3-A648-A0D3C1058A26\knsw164.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dylojixo]ImagePath=[%PROGRAM_FILES%]\E84AF480-1440270954-11E3-A648-A0D3C1058A26\knse2BC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fimevebo]ImagePath=[%PROGRAM_FILES%]\E84AF480-1440270954-11E3-A648-A0D3C1058A26\hnsp1F8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jimocoso]ImagePath=[%PROGRAM_FILES%]\E84AF480-1440270954-11E3-A648-A0D3C1058A26\jnsx1F6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nyrohode]ImagePath=[%PROGRAM_FILES%]\E84AF480-1440270954-11E3-A648-A0D3C1058A26\knse220.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soposuqy]ImagePath=[%PROGRAM_FILES%]\E84AF480-1440270954-11E3-A648-A0D3C1058A26\knsl1E0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ziqusuce]ImagePath=[%PROGRAM_FILES%]\E84AF480-1440270954-11E3-A648-A0D3C1058A26\knsm11A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dijojyvi]ImagePath=[%PROGRAM_FILES%]\88251C00-1445934410-0820-0224-145425000000\hnsd6CA0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dufizisi]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482359354-3710-8039-B3C04F4E5931\kns652.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bowymomi]ImagePath=[%PROGRAM_FILES%]\1CAE469A-1482272091-E411-85C7-F0761C80AAE8\kns36E7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1469352297-5210-8046-B1C04F435431\jnsv3ABB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1469352297-5210-8046-B1C04F435431\hnsa5168.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hesetuky]ImagePath=[%PROGRAM_FILES%]\59300289-1482250617-D10E-0A29-448A5B3FDDC4\kns3806.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rutuvobu]ImagePath=[%PROGRAM_FILES%]\98F19BD5-1482235862-11DE-BBDA-DE5E78001CC1\knsuEE42.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sinereku]ImagePath=[%PROGRAM_FILES%]\4E435451-1482278298-3032-4732-50465D3E1309\knst9391.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hesetuky]ImagePath=[%PROGRAM_FILES%]\00000000-1482257836-0000-0000-6C626D3F0983\knsx93EB.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\E59CC9D4-1455939231-E511-8B16-B05ADA571F2F\hnshA471.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\E59CC9D4-1455939231-E511-8B16-B05ADA571F2F\jnsp8667.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\berogupe]ImagePath=[%APPDATA%]\4C4C4544-1426877273-4710-8058-B4C04F325631\jnsf2AA8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hofufony]ImagePath=[%PROGRAM_FILES%]\38464E43-1480416402-3133-5053-001E68BA5DA4\knsE23A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\buvuzezo]ImagePath=[%PROGRAM_FILES%]\FFFFFFFF-1478901085-FFFF-FFFF-FFFFFFFFFFFF\knsjFB06.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dyrytury]ImagePath=[%PROGRAM_FILES%]\FFFFFFFF-1481986817-FFFF-FFFF-FFFFFFFFFFFF\knsCF5C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\54CA83FC-1471966863-8D4A-BEF2-764BBAF7E399\jnst7606.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\54CA83FC-1471966863-8D4A-BEF2-764BBAF7E399\hnsvB9C7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\resefeso]ImagePath=[%PROGRAM_FILES%]\BFCB4070-1482169271-BDE6-6630-992AF2E20A66\knsf4535.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mipelisu]ImagePath=[%PROGRAM_FILES%]\038D0240-1482203020-05AD-CD06-940700080009\knsf93CD.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KYJYBYJU]ImagePath=[%PROGRAM_FILES%]\6685284C-1482124030-11E0-8DA0-6D991031C129\knsAA7A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PURECEWE]ImagePath=[%PROGRAM_FILES%]\6685284C-1482124030-11E0-8DA0-6D991031C129\kns4B30.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wilybugy]ImagePath=[%PROGRAM_FILES%]\00000000-1482197109-0000-0000-D8CB8A5E77C8\knszFA7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hemovywi]ImagePath=[%PROGRAM_FILES%]\3ECABB40-1482206711-11D5-96B8-485B39F7F1CB\knsvAE61.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\velevuze]ImagePath=[%PROGRAM_FILES%]\40CCB380-1481936021-11DD-858C-3085A98E3186\knsd1F72.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ficufonu]ImagePath=[%PROGRAM_FILES%]\D972836C-1482046850-E111-951F-4D8F09EBC54A\kns5869.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jynujymi]ImagePath=[%PROGRAM_FILES%]\D972836C-1482046850-E111-951F-4D8F09EBC54A\kns5CFE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gokocifi]ImagePath=[%PROGRAM_FILES%]\038D0240-1475265477-0563-5406-750700080009\kns534F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wicysogi]ImagePath=[%PROGRAM_FILES%]\33444335-1482148864-4E35-4C56-A0D3C167144E\kns4315.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\82CA7B18-1461377614-AC41-A056-089E01D5DD82\hnstA547.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\82CA7B18-1461377614-AC41-A056-089E01D5DD82\jnsy4BD0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\82CA7B18-1461406716-AC41-A056-089E01D5DD82\qnsu9F7C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roqutytu]ImagePath=[%PROGRAM_FILES%]\80F0CCD1-1482039538-E011-AE8C-C89CDCBC2C6D\knsjBB93.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ficufonu]ImagePath=[%PROGRAM_FILES%]\D37A8654-1482056235-0F49-924A-F17A42578149\knsv3B47.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bivigiqo]ImagePath=[%PROGRAM_FILES%]\34ACA580-1482036319-11DF-ADFA-20CF30B53CAB\knszA347.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kelopevo]ImagePath=[%PROGRAM_FILES%]\00000000-1481881998-0000-0000-448A5B69C9D3\kns99F3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nurizovo]ImagePath=[%PROGRAM_FILES%]\C91BAF14-1482042208-E411-B2A0-1458D011783D\knsx958.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1439392113-5A10-8030-B4C04F4A5731\hnsq8E81.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cudyrybu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1439392113-5A10-8030-B4C04F4A5731\knsy442F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1439392113-5A10-8030-B4C04F4A5731\jnsl71BC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\duqewisy]ImagePath=[%PROGRAM_FILES%]\F64A52B0-1481920936-81E3-33A4-54BEF7603F63\knsg6096.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wygipiru]ImagePath=[%PROGRAM_FILES%]\F64A52B0-1482007329-81E3-33A4-54BEF7603F63\knsc28D6.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gyvixodu]ImagePath=[%PROGRAM_FILES%]\7374E600-1442131945-11D5-B18E-20CF30823C68\hnsn3E70.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lehicewu]ImagePath=[%PROGRAM_FILES%]\7374E600-1442131945-11D5-B18E-20CF30823C68\jnst27E8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\velevuze]ImagePath=[%PROGRAM_FILES%]\D8434543-1481935726-11E5-89C6-641C677E3FAB\knsc14AA.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vuxizeqe]ImagePath=[%PROGRAM_FILES%]\1E1E9B6B-1481841606-DC11-9E58-0013D4D9C940\kns445A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sipijyly]ImagePath=[%PROGRAM_FILES%]\03000200-1481697132-0500-0006-000700080009\knsq9BAC.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lyvedici]ImagePath=[%PROGRAM_FILES%]\7CCF7D7F-1481989300-11E6-B4F4-C85B766BB93D\knstBBC5.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xexyxohy]ImagePath=[%PROGRAM_FILES%]\7D08E429-1481820683-0243-9870-F079598110C2\knsu36F2.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cemoqige]ImagePath=[%PROGRAM_FILES%]\33444335-1476536356-4733-3042-A0481C02C3ED\knsl5F68.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\2411AAE0-1468918922-11B2-8000-C0634FF00FE9\jnsp24E5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\2411AAE0-1468918922-11B2-8000-C0634FF00FE9\hnsb40FB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lifoteqe]ImagePath=[%PROGRAM_FILES%]\80179E4E-1481845829-DD11-A85A-1078D2CA07C3\knsf8E13.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\citevebo]ImagePath=[%PROGRAM_FILES%]\03000200-1447441116-0500-0006-000700080009\jnsc3AA6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\463A85BC-1459573036-E211-A8C6-0013D4D9C9E8\jnslE3CD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rowugoqo]ImagePath=[%LOCAL_APPDATA%]\463A85BC-1459592919-E211-A8C6-0013D4D9C9E8\snsvF927.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\463A85BC-1459573036-E211-A8C6-0013D4D9C9E8\hnslA33.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\03000200-1457111713-0500-0006-000700080009\hnsq2742.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1458992129-0500-0006-000700080009\qnskDCFA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dojygici]ImagePath=[%PROGRAM_FILES%]\03000200-1457111713-0500-0006-000700080009\jnsfEA1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dycemumo]ImagePath=[%PROGRAM_FILES%]\6921A6A0-1480875861-11DD-842B-7824AF45AF21\knsh5BCF.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\30464E43-1466439390-3538-4652-60EB693C46D7\qnsc8A08.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qosibilo]ImagePath=[%PROGRAM_FILES%]\A0528300-1481893643-81E2-2464-AC220B0D330D\knsqF1E2.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A0528300-1481902661-81E2-2464-AC220B0D330D\qnseA7CE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gokehuqo]ImagePath=[%PROGRAM_FILES%]\00000000-1480956178-0000-0000-50E5492B4CFA\kns74E2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nujilope]ImagePath=[%PROGRAM_FILES%]\311D759F-1481821969-11E5-8299-ACE0102A60FE\knsg93EE.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lememuny]ImagePath=[%PROGRAM_FILES%]\00000000-1479990834-0000-0000-D8CB8A1D9AD6\knse8B97.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1480019679-0000-0000-D8CB8A1D9AD6\qnsz436D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tobixiku]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1481491495-4810-8044-B4C04F5A3232\knsw1421.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pokorugi]ImagePath=[%PROGRAM_FILES%]\03000200-1446404908-0500-0006-000700080009\jnsvA322.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qymylofy]ImagePath=[%PROGRAM_FILES%]\03000200-1446404908-0500-0006-000700080009\hnsvBCBC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\8C681382-1481790523-E611-B27E-EC8EB5959A2A\qnsoAD4A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gymonime]ImagePath=[%PROGRAM_FILES%]\8C681382-1481641130-E611-B27E-EC8EB5959A2A\kns5CFD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A4150F92-1481716796-11E2-9426-E488B300C047\qnsm8726.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\detupegu]ImagePath=[%PROGRAM_FILES%]\A4150F92-1477454825-11E2-9426-E488B300C047\kns3949.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pinyqopu]ImagePath=[%PROGRAM_FILES%]\03000200-1481729173-0500-0006-000700080009\knsf58ED.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1481732987-0500-0006-000700080009\qnsmA102.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gerocyni]ImagePath=[%PROGRAM_FILES%]\00000000-1458578750-0000-0000-50E5493BE46E\jnsb6E9B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rowugoqo]ImagePath=[%LOCAL_APPDATA%]\00000000-1458586047-0000-0000-50E5493BE46E\snsmE1E8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\00000000-1458578750-0000-0000-50E5493BE46E\hnsg84AC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\CF1277F8-1469115341-5E2E-9BE0-AE32630504D6\jnse40FA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\CF1277F8-1469115341-5E2E-9BE0-AE32630504D6\hnsb60A9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryjoxuze]ImagePath=[%PROGRAM_FILES%]\E218662A-1481632436-E611-B27E-A08CFD8270DA\knst54CF.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sebiwumo]ImagePath=[%PROGRAM_FILES%]\9C8ACBD8-1478881022-1520-1016-192327000000\knsz8195.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vegomeqe]ImagePath=[%PROGRAM_FILES%]\82716ACC-1481619157-4840-B910-626FA209CCCA\knsfCE11.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\82716ACC-1481597705-4840-B910-626FA209CCCA\qnsw7EF6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zumedomi]ImagePath=[%PROGRAM_FILES%]\971B21D7-1481604459-1555-6AB3-339CDC009B3B\knsf95C1.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jewicybo]ImagePath=[%PROGRAM_FILES%]\A2A8A500-1480834750-DC11-B98C-00E0188501F7\knshABE1.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nypudubi]ImagePath=[%PROGRAM_FILES%]\C99933FA-1481056103-DF11-A3E1-705AB627EFAD\kns5C31.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1453050464-0000-0000-1C6F6566641E\qnszE64B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\33444335-1453582115-5A35-5A4B-A0481C1B7B28\hnsn8C99.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\33444335-1457285587-5A35-5A4B-A0481C1B7B28\qnst2287.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\33444335-1453582115-5A35-5A4B-A0481C1B7B28\jnsi67E8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\7CCB7A90-1481146630-E311-A96A-201A063A408B\qnsd65E7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kopufyti]ImagePath=[%PROGRAM_FILES%]\00000000-1447042991-0000-0000-D43D7ED73976\knsa83AC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pyzeqewe]ImagePath=[%PROGRAM_FILES%]\00000000-1447042991-0000-0000-D43D7ED73976\jnsiE8C7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\toniqobe]ImagePath=[%PROGRAM_FILES%]\00000000-1447042991-0000-0000-D43D7ED73976\hnsy925.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wibejoxe]ImagePath=[%PROGRAM_FILES%]\33444335-1478434711-3139-3156-A0481C229950\knsu8863.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\33444335-1478454708-3139-3156-A0481C229950\qnsq9070.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tivojidu]ImagePath=[%PROGRAM_FILES%]\03000200-1481215397-0500-0006-000700080009\knsp9AD7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1481218959-0500-0006-000700080009\qnsq3408.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wufytuno]ImagePath=[%PROGRAM_FILES%]\30464E43-1476718098-3332-4A47-78ACC05CD7DC\knsoE6CB.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bokuhepe]ImagePath=[%PROGRAM_FILES%]\30464E43-1476798191-3332-4A47-78ACC05CD7DC\kns5F9E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qedukiqu]ImagePath=[%PROGRAM_FILES%]\30464E43-1481378737-4E34-4632-64315056A877\knsB30B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qimidoxe]ImagePath=[%PROGRAM_FILES%]\323A5692-1481212592-3B29-000D-FECC5E0B6D00\knsl6C65.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roxuqeny]ImagePath=[%PROGRAM_FILES%]\65B1BAC8-1481396104-11DE-8582-59D7F04BAFB0\knsy7DF0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vymirogy]ImagePath=[%PROGRAM_FILES%]\0A314FF2-1481384076-BB43-BB60-54AB3A047D56\knsk7310.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1C262B13-1481401814-DD11-A2DA-001EEC23EDA3\qnsg75EC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nokecuwo]ImagePath=[%PROGRAM_FILES%]\1C262B13-1481313791-DD11-A2DA-001EEC23EDA3\kns39F5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dodytexy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1481332258-5810-8031-B2C04F34354A\znsnE074.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qimidoxe]ImagePath=[%PROGRAM_FILES%]\35444335-1480522749-5730-4D4E-D0BF9C9E291D\kns4BB3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vukunidu]ImagePath=[%PROGRAM_FILES%]\1E00F420-1479483786-AA00-54A4-90E6BA21AF99\kns1180.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1E00F420-1481303808-AA00-54A4-90E6BA21AF99\qnsnE5D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zuwinuni]ImagePath=[%PROGRAM_FILES%]\1E00F420-1479483786-AA00-54A4-90E6BA21AF99\kns2B78.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ludyniru]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1481315526-5610-804A-CAC04F52344A\knsb765F.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jyjyveny]ImagePath=[%PROGRAM_FILES%]\8F2E09A9-1481293894-E311-9AE7-201A0626D9A5\knsh4D2D.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\675517FA-1456699374-E411-A961-68F728BF8FD0\qnskE960.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dofyliky]ImagePath=[%PROGRAM_FILES%]\35444335-1481196919-4637-5452-B05ADAD34D12\knsxD7EB.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mycizihu]ImagePath=[%PROGRAM_FILES%]\35444335-1481222365-4637-5452-B05ADAD34D12\knsu758A.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wytomedo]ImagePath=[%PROGRAM_FILES%]\35444335-1481183424-4637-5452-B05ADAD34D12\knsd496C.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qimidoxe]ImagePath=[%PROGRAM_FILES%]\35444335-1481199380-4637-5452-B05ADAD34D12\knsB4A5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\35444335-1481202572-4637-5452-B05ADAD34D12\qnsp7A3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jicijesu]ImagePath=[%PROGRAM_FILES%]\D94E0FA8-1480773458-E411-AA1F-F0761C3B8094\kns96C4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qimidoxe]ImagePath=[%PROGRAM_FILES%]\D94E0FA8-1480773458-E411-AA1F-F0761C3B8094\knsD724.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\00000000-1463761514-0000-0807-060504030201\jnslBD1D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\00000000-1463761514-0000-0807-060504030201\hnst10BD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1463783436-0000-0807-060504030201\qnsyCC46.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\27132E90-1479822199-CA50-4F3B-2C27D7AA3FCC\qnsb14AD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\buzupuzu]ImagePath=[%PROGRAM_FILES%]\27132E90-1479414483-CA50-4F3B-2C27D7AA3FCC\knsD73D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bunynoci]ImagePath=[%PROGRAM_FILES%]\E16249DC-1481117950-11E6-914E-C9B0E60260BC\knsqEDF2.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hunylyri]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1481139345-4E10-8035-C6C04F574232\knsmD562.tmpfs
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Signified\campy.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vikevewy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1480986500-3610-8032-B7C04F515831\kns4095.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tepygehe]ImagePath=[%PROGRAM_FILES%]\03AA02FC-1480352921-05B5-2E06-810700080009\kns2AEC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cotecici]ImagePath=[%PROGRAM_FILES%]\765AC6DD-1480921991-11DE-BBDA-B30E91690025\knsp5F23.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cucokojo]ImagePath=[%PROGRAM_FILES%]\3CDAD402-1481104485-4647-B2AC-63096C87E12B\knsw42BE.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vukizote]ImagePath=[%APPDATA%]\44057A77-1428643917-29CB-3FC7-5838841B4152\jnse90C9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mijibowy]ImagePath=[%PROGRAM_FILES%]\44057A77-1428643917-29CB-3FC7-5838841B4152\kns568C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\934C83A0-1481077911-81E2-375F-7C0507276D2F\qnsz8031.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jefopyle]ImagePath=[%PROGRAM_FILES%]\0C659BE6-1481066801-DD11-AF41-00199938C51C\knst135D.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\0C659BE6-1481072624-DD11-AF41-00199938C51C\qnspD3FB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nobiceqy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1480986500-3610-8032-B7C04F515831\kns50D8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mojevepi]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1480986500-3610-8032-B7C04F515831\kns7A68.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kolutyjo]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1480986500-3610-8032-B7C04F515831\kns68BE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cuqisiqe]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1481028550-3910-8051-B8C04F343132\znsaBDCD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fibujone]ImagePath=[%PROGRAM_FILES%]\FCB2D880-1480681919-11E1-82E8-ECA86B73EE25\kns7AF7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fyqosewu]ImagePath=[%PROGRAM_FILES%]\8DFF7EDA-1481043536-B2F6-7CD8-F832E4BD1E9E\knsv4DB1.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kybyqury]ImagePath=[%PROGRAM_FILES%]\FFFFFFFF-1479139882-FFFF-FFFF-FFFFFFFFFFFF\knsgB1D5.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1469085989-3410-8053-C6C04F595A31\jnsn4EFB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1469085989-3410-8053-C6C04F595A31\hnsd8EBB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1469113270-3410-8053-C6C04F595A31\qnsk7014.tmp