Exterminate It! Antimalware

malpedia

Known threats:687,615 Last Update:December 02, 10:02

Testimonials

Just want to say that apparently your Exterminate It has worked like a charm. I was infected with a most troublesome Malware Trojan that kept replicating every time McAfee found, blocked and removed it... most annoying for several days... until Mr. Google led me to your door. What a God send!

With thanks,

Tom S.

MultiPlug- Registry Values List

This is a complete list of MultiPlug registry values collected by Exterminate It!. If you find any of these registry values on your PC, your computer is very likely to be infected with the MultiPlug - adware.

IMPORTANT: Because the registry is a core component of your Windows system, it is strongly recommended that you back up the registry before you begin deleting keys and values. For information about backing up the Windows registry, refer to the Registry Editor online help.
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vupuligo]ImagePath=[%APPDATA%]\00000011-1433229922-0000-0000-BCEE7B4FA98C\nssCDD5.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\timuneqi]ImagePath=[%APPDATA%]\00000011-1433229922-0000-0000-BCEE7B4FA98C\hnst3590.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fuwykory]ImagePath=[%LOCAL_APPDATA%]\00000011-1433255340-0000-0000-BCEE7B4FA98C\snsiC7E4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cirysibo]ImagePath=[%APPDATA%]\00000011-1433229922-0000-0000-BCEE7B4FA98C\jnse1C1B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyboniby]ImagePath=[%PROGRAM_FILESX86%]\C1CBAD60-1447037275-81E4-39DB-7824AFB4C8A2\knsxB8A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vyjyhefe]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1476454793-5410-8034-B2C04F4B4731\knst6C40.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\58DE0196-1460214488-DE11-B698-705AB653859C\jnsfFD83.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\58DE0196-1460214488-DE11-B698-705AB653859C\hnsp1539.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tisydyho]ImagePath=[%LOCAL_APPDATA%]\9E0E4BFC-1428588077-2347-A05E-089E01ADF0F3\snsv4FB7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\disigijy]ImagePath=[%LOCAL_APPDATA%]\9E0E4BFC-1428588059-2347-A05E-089E01ADF0F3\cnsq19FA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gupywery]ImagePath=[%PROGRAM_FILES%]\C9A07780-1481220150-11DE-98EA-90E6BABC1F6F\knsjC36B.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\F06647FC-1459923792-E011-8BC1-00266CAD945C\jnsg7ABE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\F06647FC-1459923792-E011-8BC1-00266CAD945C\hnsm99F4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\F06647FC-1465100090-E011-8BC1-00266CAD945C\jnst87D9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03AA02FC-1459006911-058D-D206-7B0700080009\qnsw1FB2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gerocyni]ImagePath=[%PROGRAM_FILES%]\498626D9-1457969249-11DD-4180-6D990C58D929\jnsxD765.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\038D0240-1460598787-0521-4206-990700080009\hnsf7D8D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\E04E7BDF-1439812141-E111-A475-00266CE616C3\jnsr1DFA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fegysehe]ImagePath=[%PROGRAM_FILES%]\E04E7BDF-1439812141-E111-A475-00266CE616C3\knsmFDD7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\E04E7BDF-1439812141-E111-A475-00266CE616C3\hnsw3801.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1458246353-4710-804C-C7C04F594431\qnsb24B1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rowugoqo]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1458245436-4710-804C-C7C04F594431\snsg15A4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\F8F59000-1491063075-0000-0000-000000000000\qnsj71C7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\279669C3-1452305192-DE11-972B-002622EA2574\hnsnA7F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\279669C3-1452305192-DE11-972B-002622EA2574\jnscBEAE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gyvixodu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1441975461-5010-804B-B3C04F425A31\hnsz7002.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\duxupuke]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1441975461-5010-804B-B3C04F425A31\knsu3CF9.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qotuxyfe]ImagePath=[%PROGRAM_FILES%]\03AA02FC-1474710184-0575-4D06-720700080009\knsf32D9.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lovuvudo]ImagePath=[%PROGRAM_FILES%]\A04DE000-1444765886-0000-0807-060504030201\jnseFBF6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dijojyvi]ImagePath=[%PROGRAM_FILES%]\A04DE000-1444765886-0000-0807-060504030201\hnsy2326.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cogiwosi]ImagePath=[%PROGRAM_FILES%]\A04DE000-1444765886-0000-0807-060504030201\knsdC601.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\C1013B99-1459526701-59C4-93EC-E87DFA0558A9\jnsx2299.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\C1013B99-1459526701-59C4-93EC-E87DFA0558A9\hnss3782.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\0F556020-1482923564-11D9-993C-5404A6C14C78\qnsr61D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xyqipece]ImagePath=[%PROGRAM_FILES%]\0F556020-1482603003-11D9-993C-5404A6C14C78\knsA472.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wygunoru]ImagePath=[%PROGRAM_FILES%]\0F556020-1482919905-11D9-993C-5404A6C14C78\knsb1DA7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1463184131-4A10-8035-C3C04F334E31\qnsgFC2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1460999792-4A10-8035-C3C04F334E31\jnsq3A50.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1460999792-4A10-8035-C3C04F334E31\hnsr5711.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vydojico]ImagePath=[%LOCAL_APPDATA%]\03000200-1427894470-0500-0006-000700080009\snsn429.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qulyripy]ImagePath=[%APPDATA%]\03000200-1427883451-0500-0006-000700080009\nsnBE9A.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sutyjipe]ImagePath=[%APPDATA%]\03000200-1427883451-0500-0006-000700080009\jnsnEFE2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\puroquby]ImagePath=[%LOCAL_APPDATA%]\03000200-1427895074-0500-0006-000700080009\insz3FE0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mydumonu]ImagePath=[%LOCAL_APPDATA%]\03000200-1427894455-0500-0006-000700080009\cnsvCA9D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\AC6B3357-1437908508-9CD0-99EC-40A8F00128FA\snsdF83.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mekupide]ImagePath=[%LOCAL_APPDATA%]\8570F960-1431966527-11D5-8747-10BF48769DC8\cnsx6655.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zypykejy]ImagePath=[%PROGRAM_FILES%]\03000200-1447390283-0500-0006-000700080009\jnsc73.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zituxuhu]ImagePath=[%PROGRAM_FILES%]\03000200-1447390283-0500-0006-000700080009\hnsp7D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fobytosy]ImagePath=[%PROGRAM_FILES%]\7DDA4760-1482596146-11DD-96F7-305A3A47CD82\kns5A6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zupyfezu]ImagePath=[%PROGRAM_FILES%]\8295024F-1449708368-E211-9E12-6C3BE5853A83\knskD2F3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rizyqibe]ImagePath=[%PROGRAM_FILES%]\8295024F-1449708368-E211-9E12-6C3BE5853A83\jnsn509E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vofohope]ImagePath=[%APPDATA%]\25AACFC9-1430106464-56AD-3D08-81CBD35ED998\jnso153F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1457007932-5310-8054-C4C04F4B5331\hnse9B38.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dojygici]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1457007932-5310-8054-C4C04F4B5331\jnsy817E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zyvirigo]ImagePath=[%PROGRAM_FILES%]\34C182A5-1445567097-E411-B2A0-3464A9785F99\jnsgF703.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zewyfegy]ImagePath=[%LOCAL_APPDATA%]\34C182A5-1445586972-E411-B2A0-3464A9785F99\snsoBCD6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hiluzepy]ImagePath=[%PROGRAM_FILES%]\34C182A5-1445567097-E411-B2A0-3464A9785F99\knsv4EB0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dijojyvi]ImagePath=[%PROGRAM_FILES%]\34C182A5-1445567097-E411-B2A0-3464A9785F99\hnsr1144.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xiwezewy]ImagePath=[%APPDATA%]\B3E9C0C0-1431607457-11D5-835C-002618B591DC\jnsmEC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soxocusy]ImagePath=[%APPDATA%]\B3E9C0C0-1431607457-11D5-835C-002618B591DC\hnsfEE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\totyseku]ImagePath=[%PROGRAM_FILES%]\008AAA9F-1440911413-DC11-829C-89F247DBA73A\hnsnCFDE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kipysoqy]ImagePath=[%PROGRAM_FILES%]\008AAA9F-1440911413-DC11-829C-89F247DBA73A\knsw701B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jimocoso]ImagePath=[%PROGRAM_FILES%]\008AAA9F-1440911413-DC11-829C-89F247DBA73A\jnstAC08.tmp
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\menfolk\kvamme.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Moniz\fluoride.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\34444335-1460456548-3635-5235-8CDCD4861ABB\qnsb9A75.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zevoseri]ImagePath=[%PROGRAM_FILES%]\DD8E4A8A-1439558773-2B20-FA98-F07959904CAF\knsh329E.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\DD8E4A8A-1439558773-2B20-FA98-F07959904CAF\jnss57C1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\DD8E4A8A-1439587619-2B20-FA98-F07959904CAF\snscD2BC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\DD8E4A8A-1439558773-2B20-FA98-F07959904CAF\hnsh7080.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\32444335-1464820332-3433-4452-80C16E5111F6\hnse96F8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\32444335-1464820332-3433-4452-80C16E5111F6\jnsp7CB3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gohorogu]ImagePath=[%PROGRAM_FILES%]\BFA5AA49-1477661375-B16D-0772-D02788B39074\knsr75A2.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nisecine]ImagePath=[%PROGRAM_FILES%]\38DB09A6-1478445601-B344-8A30-14DDA9BCEC3B\knsC83A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tirozibo]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1480241793-4D10-8048-B7C04F475731\knsw13DB.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cicyjyqu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1479191086-4D10-8048-B7C04F475731\knse328B.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fuwiqywi]ImagePath=[%APPDATA%]\84DF8440-1431858104-11D5-9E63-5404A66A4252\nsf6698.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tefywypi]ImagePath=[%APPDATA%]\84DF8440-1431858104-11D5-9E63-5404A66A4252\jnsfA86E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rivupesi]ImagePath=[%APPDATA%]\84DF8440-1431858104-11D5-9E63-5404A66A4252\hnsfD4EC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1470413413-5310-804E-B2C04F513032\hnsn52A5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1470413413-5310-804E-B2C04F513032\jnss3874.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jimocoso]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1440645896-4210-804C-B4C04F345931\jnsg5EB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\totyseku]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1440645896-4210-804C-B4C04F345931\hnsw1D25.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sofizebu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1440645896-4210-804C-B4C04F345931\knsbE74E.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1440674749-4210-804C-B4C04F345931\snsb9DC9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\B7BD2C60-1470257753-11B2-8000-CB27264863CD\hnsd466B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\B7BD2C60-1470257753-11B2-8000-CB27264863CD\jnsa2738.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\78876BE0-1452987190-11D5-BF7C-14DAE967288C\jnsb640F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\78876BE0-1452987190-11D5-BF7C-14DAE967288C\hnsw9E24.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vodyhuso]ImagePath=[%PROGRAM_FILES%]\03000200-1449082999-0500-0006-000700080009\jnsgD1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tuvogote]ImagePath=[%PROGRAM_FILES%]\03000200-1449082999-0500-0006-000700080009\hnseD7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pewyxuku]ImagePath=[%LOCAL_APPDATA%]\03000200-1449061434-0500-0006-000700080009\snstF9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lofucoti]ImagePath=[%PROGRAM_FILES%]\6A90EFE9-1449186342-C74B-B172-840D5EE40749\knsc7481.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\03000200-1457874064-0500-0006-000700080009\hnsvB993.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\peribeby]ImagePath=[%PROGRAM_FILES%]\8064A5D2-1475816921-E211-8444-2089849F56EC\kns6D54.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\howygypi]ImagePath=[%PROGRAM_FILES%]\8064A5D2-1475816921-E211-8444-2089849F56EC\kns647E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\colipelu]ImagePath=[%PROGRAM_FILES%]\8064A5D2-1475816921-E211-8444-2089849F56EC\knsB7AC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lehicewu]ImagePath=[%PROGRAM_FILES%]\35444335-1442092551-3830-3254-3CA82AB2C54E\jnsfB498.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dopupugy]ImagePath=[%PROGRAM_FILES%]\35444335-1442092551-3830-3254-3CA82AB2C54E\knsy995D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\20503452-1461444452-122C-AB18-98C49808219F\jnso7D0C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\20503452-1461444452-122C-AB18-98C49808219F\hnsw7430.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1454109086-0000-0000-000000000000\qnsc8F56.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gibufyco]ImagePath=[%PROGRAM_FILES%]\00000000-1482669458-0000-0000-6CF049A428D8\knsyD888.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mozotybo]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1445495090-4210-8034-B8C04F345931\knsm3FDB.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fimuzywe]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1445495090-4210-8034-B8C04F345931\jnsr768A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vitunydu]ImagePath=[%PROGRAM_FILES%]\000B7784-1478648026-DE11-BBAE-00251114562D\knsu5ACD.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\1D40E4B7-1458758805-E011-8034-1C7508609792\hnsfA575.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gerocyni]ImagePath=[%PROGRAM_FILES%]\1D40E4B7-1458758805-E011-8034-1C7508609792\jnstC429.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zizusyju]ImagePath=[%PROGRAM_FILES%]\12345678-1450765153-5678-90AB-CDDEEFAABBCC\hnsg1B8E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\12345678-1461069586-5678-90AB-CDDEEFAABBCC\qnsd6E7D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rizyqibe]ImagePath=[%PROGRAM_FILES%]\12345678-1450765153-5678-90AB-CDDEEFAABBCC\jnswED4C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xekyqezy]ImagePath=[%PROGRAM_FILES%]\20354878-1481266724-DB11-807E-001DBA0087F1\knsB1A6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1451336495-5010-8036-C6C04F445231\hnsa79C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1451336495-5010-8036-C6C04F445231\jnsvE07B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1465926627-5010-8036-C6C04F445231\qnss88E0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\woforemu]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1451347398-5010-8036-C6C04F445231\snsb1275.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\novibivo]ImagePath=[%PROGRAM_FILES%]\33444335-1475088115-4234-3138-38EAA7ED4741\knsFFC5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\01504772-1464472243-E211-9704-28D2440A779D\qnsi4848.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\myxuceto]ImagePath=[%PROGRAM_FILES%]\DE813CDC-1476117379-D074-D800-002618873215\knsD32A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\ADF22EE0-1454728356-11B2-8000-CCBC563BE5E1\qnspE59F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sitysese]ImagePath=[%PROGRAM_FILES%]\823C30C1-1474705771-D3F1-46ED-1A449F9B9413\knsdABC0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\823C30C1-1464515227-D3F1-46ED-1A449F9B9413\hnsyA518.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\823C30C1-1464515227-D3F1-46ED-1A449F9B9413\jnss8A74.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\0BB3FB44-1460255532-D9ED-2E36-9C5C8E8E6F61\hnsrE4FF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lomyqoxu]ImagePath=[%PROGRAM_FILES%]\03D40274-1439293623-0577-4306-EA0700080009\knsz667A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\03D40274-1439293623-0577-4306-EA0700080009\jnskC39B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\03D40274-1439300981-0577-4306-EA0700080009\snsa7C90.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\03D40274-1439293623-0577-4306-EA0700080009\hnslE6A8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1483206723-0000-0000-000000000000\qnsu986A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sicyvifi]ImagePath=[%PROGRAM_FILES%]\00000000-1483203054-0000-0000-000000000000\knsu9580.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryveqopy]ImagePath=[%PROGRAM_FILES%]\C881A809-1491951568-E311-A672-201A06AD4993\znspF4FA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A9B93F20-1468938399-11B2-8000-E117998312E4\qnseBA52.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\A9B93F20-1439071672-11B2-8000-E117998312E4\jnsn3E28.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\A9B93F20-1439079064-11B2-8000-E117998312E4\snso79B4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\A9B93F20-1439071672-11B2-8000-E117998312E4\hnsdE8DA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mewikizy]ImagePath=[%PROGRAM_FILES%]\33444335-1482596759-4735-3248-D4C9EF6714C3\knsBC20.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1465309117-0000-0000-D8CB8A57E4D0\qnsj736F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vixepoqo]ImagePath=[%PROGRAM_FILES%]\03000200-1444816784-0500-0006-000700080009\knsu8D6C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tityhejo]ImagePath=[%PROGRAM_FILES%]\03000200-1444816784-0500-0006-000700080009\knsuB62F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kodilody]ImagePath=[%PROGRAM_FILES%]\03000200-1444816784-0500-0006-000700080009\jnss97FC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dijojyvi]ImagePath=[%PROGRAM_FILES%]\03000200-1444816784-0500-0006-000700080009\hnsiBD88.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\00000000-1437663985-0000-0000-6CF049EFD3C3\jnsv539C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\filowyto]ImagePath=[%PROGRAM_FILES%]\00000000-1437663985-0000-0000-6CF049EFD3C3\knsfCA1C.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\00000000-1437663985-0000-0000-6CF049EFD3C3\hnsq7ACD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\03000200-1462005657-0500-0006-000700080009\jnsj9AF7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\03000200-1462005657-0500-0006-000700080009\hnslB98D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\juboloso]ImagePath=[%APPDATA%]\4C4C4544-1431322795-3410-8047-C6C04F515831\nss7D37.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\34444335-1456574657-3830-314D-3863BB97B12C\jnso3C12.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\34444335-1456574657-3830-314D-3863BB97B12C\hnsn5F6B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sylixixu]ImagePath=[%PROGRAM_FILES%]\06EDD84B-1476381884-E211-9D7B-B888E3CC11AC\kns5581.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\digelepo]ImagePath=[%PROGRAM_FILES%]\00000000-1468190750-0000-0000-001D7D008CF3\knsFDB9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\5D3643A0-1453268221-11E1-A75B-4C72B91D026A\jnsr1841.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486325593-5210-8039-B2C04F353032\qnsf6569.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pisuboke]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1479748349-5A10-804A-B5C04F343332\kns2C6C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ziminylu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1455638017-5310-8046-C8C04F4C3532\knsi27AB.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1455638017-5310-8046-C8C04F4C3532\hnsw86F5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\E6626351-1464846735-85E9-3C48-1C7508288244\hnsn4D69.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\13ED999B-1462078333-E011-BCDC-1C75089F27D0\jnsz6F43.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\13ED999B-1462078333-E011-BCDC-1C75089F27D0\hnsz950D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1455099277-5110-8048-C4C04F333032\jnspE56D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1455099277-5110-8048-C4C04F333032\hnseFDDE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\80B1DC1E-1467281787-DB11-8B8B-81061EF8A680\qnsmF846.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\80B1DC1E-1464260287-DB11-8B8B-81061EF8A680\hnswF7EE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\80B1DC1E-1464260287-DB11-8B8B-81061EF8A680\jnsgC3DC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xytekyby]ImagePath=[%PROGRAM_FILES%]\F3D5FD01-1474122589-DA89-D153-10604B4874EF\knsmA32A.tmpfs
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto=notepad
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\predetermined\houghton.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Locomotives\suis.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\predetermined\whittled.exe"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Locomotives\suis.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sypobose]ImagePath=[%APPDATA%]\4C4C4544-1433757269-4A10-804C-B9C04F565331\nst8786.tmp
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto=32013434.bat
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1462697311-5910-8053-B9C04F324253\hnsc28D6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gyciteli]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1462697311-5910-8053-B9C04F324253\jnsxF97B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dojygici]ImagePath=[%PROGRAM_FILES%]\819242F7-1457175225-CB11-A9A4-E18683CB2CB2\jnsl669.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\819242F7-1457175225-CB11-A9A4-E18683CB2CB2\hnsq4ACA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\9D855900-1491329967-81DE-2666-00248C5989B1\qnsm19F8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\60C6945C-1461150231-E211-B9B5-9DEE1DAD3B8C\qnsd70DD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidekoqe]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1450707562-4B10-804E-C4C04F4A5731\qnsn3E9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zizusyju]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1450059886-4B10-804E-C4C04F4A5731\hnsu244B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\woforemu]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1450088747-4B10-804E-C4C04F4A5731\snsk9B20.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rizyqibe]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1450059886-4B10-804E-C4C04F4A5731\jnskFA9B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\keneqiwe]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1450059886-4B10-804E-C4C04F4A5731\knsiB824.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jimocoso]ImagePath=[%PROGRAM_FILES%]\03000200-1440516728-0500-0006-000700080009\jnsq25D9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\03000200-1440531187-0500-0006-000700080009\snsaCA44.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fimevebo]ImagePath=[%PROGRAM_FILES%]\03000200-1440516728-0500-0006-000700080009\hnsv4D96.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dejugyqu]ImagePath=[%PROGRAM_FILES%]\03000200-1440516728-0500-0006-000700080009\knsqFFBD.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dyrepeku]ImagePath=[%APPDATA%]\4C4C4544-1426312540-3610-8052-B2C04F375231\nsz20D6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bohihozy]ImagePath=[%APPDATA%]\4C4C4544-1426312540-3610-8052-B2C04F375231\jnssCB3B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\31464E43-1461596589-5931-4A4D-2C27D7D78466\jnsq5254.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\7E5BBB20-1463420408-11D5-A4BE-5404A69876D4\hnsi8554.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\7E5BBB20-1463420408-11D5-A4BE-5404A69876D4\jnscE31A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1486842268-0500-0006-000700080009\qnsfBE0F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryveqopy]ImagePath=[%PROGRAM_FILES%]\03000200-1488887456-0500-0006-000700080009\znsn412A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\FC818C94-1491769259-614A-BFB0-BA466FA3C40D\qnsy2946.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nimybibi]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1480151648-4E10-8056-B3C04F393832\knsA028.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tokypoqo]ImagePath=[%PROGRAM_FILES%]\4B435451-1475039410-3037-4931-5404A67602AE\knsg9F12.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\5498228C-1460634906-44DE-B5CE-1C987DD61CA6\jnse6968.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\5498228C-1460634906-44DE-B5CE-1C987DD61CA6\hnsy9B28.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\3D8BDBD7-1457765996-E441-8572-60EB69AD7861\qnssB34A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\7B691300-1440812537-11E0-A208-F46D045C44ED\snsoE3E2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\46364331-1453378628-3234-4630-3843FFFFFFFF\qnsqD3C6.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\totyseku]ImagePath=[%PROGRAM_FILES%]\7B691300-1440837693-11E0-A208-F46D045C44ED\hnso7EC9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cocokuse]ImagePath=[%PROGRAM_FILES%]\7B691300-1440837693-11E0-A208-F46D045C44ED\knse4673.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\7B691300-1438658382-11E0-A208-F46D045C44ED\hnsg3FED.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\copiheze]ImagePath=[%PROGRAM_FILES%]\7B691300-1438658382-11E0-A208-F46D045C44ED\knsg7373.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\7B691300-1438658382-11E0-A208-F46D045C44ED\jnswE001.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jimocoso]ImagePath=[%PROGRAM_FILES%]\7B691300-1440837693-11E0-A208-F46D045C44ED\jnst6242.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryveqopy]ImagePath=[%PROGRAM_FILES%]\CCA71F00-1490895399-81E3-3434-40167E08E38C\znsa2EFD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dogyquby]ImagePath=[%PROGRAM_FILES%]\9C074B2A-1476368461-E411-B2A0-645106AFE7D9\knsBF0A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\8CC3EA38-1491237308-75A6-C72C-9C5C8E7C821D\qnsaD50C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1491060645-4C10-8057-C6C04F443332\qnszCA93.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1471876074-3410-8044-B8C04F4E344A\hnsn9C27.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1471876074-3410-8044-B8C04F4E344A\jnst7D32.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\11B4DEFC-1490925023-36D6-5CDF-A01D48685655\qnsj20C3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\DF34A2C0-1490010232-11E5-9F70-08DA3CDA2200\qnsr234B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\deluxewo]ImagePath=[%PROGRAM_FILES%]\1DF72720-1481453577-11DE-826F-78843CE10B7F\kns73DC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1DF72720-1489878292-11DE-826F-78843CE10B7F\qnsd4071.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03D40274-1490791200-05AF-0906-8A0700080009\qnst6FD5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qotevydu]ImagePath=[%PROGRAM_FILES%]\03D40274-1483088819-05ED-6F06-C20700080009\knsw26F8.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1483964140-4E10-8036-B5C04F423731\qnsb488F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vyzequwu]ImagePath=[%PROGRAM_FILES%]\AEB86140-1453296383-11DF-B651-60EB698BE4E6\znsg564F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1490614514-0500-0006-000700080009\qnsmD912.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\C82C81E6-1490542581-11DF-0999-6D9912383D29\qnsp501D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vomokuqo]ImagePath=[%PROGRAM_FILES%]\5C74B200-1475612947-1014-BFAF-B9654C4E4372\kns3BA1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A0B6BACA-1490290466-E111-8CE3-DF27F27534A7\qnsrF88B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kecuqudy]ImagePath=[%PROGRAM_FILES%]\DF942B00-1481648376-11E2-9EBA-089E01859A1B\knsDF1A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\DF942B00-1484606178-11E2-9EBA-089E01859A1B\qnsh9619.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\totyseku]ImagePath=[%PROGRAM_FILES%]\215A1793-1441529420-11E4-A961-68F728AF2AF0\hnsi9457.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sipoqowu]ImagePath=[%LOCAL_APPDATA%]\80F92421-1447634978-DF11-9B65-00266C58E3E9\snsdA623.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pojilupu]ImagePath=[%PROGRAM_FILES%]\80F92421-1447627701-DF11-9B65-00266C58E3E9\knsz6085.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidekoqe]ImagePath=[%LOCAL_APPDATA%]\80F92421-1447639039-DF11-9B65-00266C58E3E9\qnsy9A52.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fosukuby]ImagePath=[%PROGRAM_FILES%]\80F92421-1447627701-DF11-9B65-00266C58E3E9\jnstB9D1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bupevixo]ImagePath=[%PROGRAM_FILES%]\80F92421-1447627701-DF11-9B65-00266C58E3E9\hnsyEA16.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sukoguzo]ImagePath=[%APPDATA%]\FFFFFFFF-1427304304-FFFF-FFFF-FFFFFFFFFFFF\nsx13D.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\joqenobi]ImagePath=[%APPDATA%]\FFFFFFFF-1427304304-FFFF-FFFF-FFFFFFFFFFFF\jnsu144.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\73AC7A2D-1489682031-11E3-834B-B30DCA0380AB\qnse897E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\77B6EF0A-1488476458-E011-A11C-B870F4FF7F47\qnss6E20.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1306A2E7-1489611283-B249-A3E9-54AB3A2C15AB\qnsw5E90.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vebokyqu]ImagePath=[%PROGRAM_FILES%]\CC93AC20-1479041789-11E1-A64F-5404A6C234FB\knse7EB5.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\03000200-1437952308-0500-0006-000700080009\jnsaB9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\03000200-1437952308-0500-0006-000700080009\hnsfBB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hycybumi]ImagePath=[%PROGRAM_FILES%]\2F787CF1-1476614936-E111-8EDA-2C27D725B21D\knsq26C9.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vevisyde]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns350D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sylixixu]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns3253.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\meguqysy]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns5107.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zozygipy]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns4F28.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wyriroso]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns1309.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sodurufo]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns9242.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servervo]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns6739.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pumuqylu]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns7EB2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bogyjyqu]ImagePath=[%PROGRAM_FILES%]\310BDDEF-1472151981-E011-A284-DC0EA132473F\kns6EDF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vupikugu]ImagePath=[%APPDATA%]\2A81DD95-1431809964-E411-B2A0-1458D0C12661\nsh400C.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tygixyzy]ImagePath=[%LOCAL_APPDATA%]\2A81DD95-1431785300-E411-B2A0-1458D0C12661\cnsdE4D1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qyrisyry]ImagePath=[%APPDATA%]\2A81DD95-1431809964-E411-B2A0-1458D0C12661\hnswD1DB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jefusocu]ImagePath=[%LOCAL_APPDATA%]\2A81DD95-1431785339-E411-B2A0-1458D0C12661\snsq50B8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\citefiky]ImagePath=[%APPDATA%]\2A81DD95-1431809964-E411-B2A0-1458D0C12661\jnsp3606.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\DE8130F0-1488722106-5FBA-EF80-0026183959AE\qnsbCD8F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ginomede]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1480026093-5710-8044-CAC04F304D31\kns2B2B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1489177837-5710-8044-CAC04F304D31\qnsdEA6D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\32354341-1439210037-3034-3132-354231314531\hnsz19F2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zirudeho]ImagePath=[%APPDATA%]\2850BAC7-1430432609-CC5A-E0F5-1A0D96F33861\nslDC84.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\32444335-1488423200-3735-5652-A0B3CC7FA549\qnsgE310.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryveqopy]ImagePath=[%PROGRAM_FILES%]\32444335-1487951591-3735-5652-A0B3CC7FA549\znscDF0D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\humywimy]ImagePath=[%PROGRAM_FILES%]\00000000-1475135355-0000-0000-4CCC6A00CC5D\knsaF01D.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\BC06F680-1488450148-11DD-A92F-001FC6C8E845\qnswF8C2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dihylezy]ImagePath=[%PROGRAM_FILES%]\F549EE43-1476375577-7B4A-9B6C-F079594DD69C\kns580.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zizusyju]ImagePath=[%PROGRAM_FILES%]\00900581-1450715172-E011-AC37-8BDF90B24220\hnsjD05.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\007CC6E1-1487868544-DF11-ACAA-00266C845405\qnssD1EA.tmp
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto="[%PROGRAM_FILES%]\sinner\tender.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\sinner\literary.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\sinner\tender.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pusyqyhi]ImagePath=[%PROGRAM_FILES%]\D6C23FE7-1479204738-11DC-BBDA-0B6A0A17001E\knsf609E.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zejytose]ImagePath=[%APPDATA%]\E9B76412-1436857756-E4E1-BE39-60A44C2BA0C1\jnsqE973.tmp
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\edifying\skittles.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\edifying\azerbaijan.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cicifiso]ImagePath=[%APPDATA%]\80D67EFE-1424258618-DE11-850C-001DBAF7AF71\nsp7578.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cunofozu]ImagePath=[%APPDATA%]\FFFFFFFF-1429368732-FFFF-FFFF-FFFFFFFFFFFF\nsc5B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gusenuzi]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1429376172-FFFF-FFFF-FFFFFFFFFFFF\snswAF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gosesoky]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1429480110-FFFF-FFFF-FFFFFFFFFFFF\insh62.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gorikyzo]ImagePath=[%APPDATA%]\FFFFFFFF-1429368732-FFFF-FFFF-FFFFFFFFFFFF\jnse66.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\domezeli]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1429376160-FFFF-FFFF-FFFFFFFFFFFF\cnstA5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\38464E43-1484872237-5633-4E31-001E68BA1C51\qnsnC458.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nomeryme]ImagePath=[%PROGRAM_FILES%]\F819587A-1481061439-D8E2-2321-B7FDB40DC2B7\knsa8668.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\2F9E3793-1466257472-DF11-B560-705AB65D3003\hnsoCC84.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\2F9E3793-1466257472-DF11-B560-705AB65D3003\jnsoB5A8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pisuboke]ImagePath=[%PROGRAM_FILES%]\33444335-1479392111-5035-3652-38EAA7EEA55C\knsCE26.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\teqypyfi]ImagePath=[%PROGRAM_FILES%]\A07DF677-1475912415-E111-9C47-00266C0710B5\knsaD9F9.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nogyliki]ImagePath=[%PROGRAM_FILES%]\8BC83000-1481229604-11E0-0000-3CD92B59C492\knsD605.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\boxexycu]ImagePath=[%PROGRAM_FILES%]\8BC83000-1483200162-11E0-0000-3CD92B59C492\kns710C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A57EA8E4-1487518990-CE04-DEFC-2C27D7B4BE27\qnsjBDC7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1472134070-5A10-804B-B5C04F353432\hnsl6F08.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1472134070-5A10-804B-B5C04F353432\jnsb513B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\33444335-1462975137-4236-4C51-A0481C0F768A\qnsm2C16.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\33444335-1460419248-4236-4C51-A0481C0F768A\jnssA7CC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\33444335-1460419248-4236-4C51-A0481C0F768A\hnslD6CD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\9014E658-1487410104-E511-90AB-DC4A3E176FF3\qnssF770.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\670864FF-1460581689-11E3-A300-2286570180FF\hnsl7683.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\41313030-1452807705-4639-3438-45464D9F48EF\jnsk190C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\FFFFFFFF-1485987410-FFFF-FFFF-FFFFFFFFFFFF\qnspA837.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\03000200-1461427730-0500-0006-000700080009\hnsx7C53.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1487286084-0500-0006-000700080009\qnsx17D7.tmp
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]autoauto="[%PROGRAM_FILES%]\victuals\mcdowall.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\victuals\afterthoughts.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\victuals\mcdowall.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zizusyju]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1449803435-3510-804E-B7C04F5A3032\hnsx35C2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tetobepu]ImagePath=[%PROGRAM_FILES%]\927F0C84-1459453681-E511-8273-54EE75659024\kns52E5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\34444335-1487085372-4730-5143-6CC21771B2F0\qnse3552.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\42B776BE-1487095760-DD11-BA86-001EEC98EB22\qnsn5415.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4085019B-1485439004-E111-A569-A18099770A04\qnsd6D55.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xunuloci]ImagePath=[%PROGRAM_FILES%]\BB1F9B01-1445561102-E111-8066-DC0EA1E304B9\knssD827.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\focohyzo]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1473535637-4D10-804E-B8C04F545031\knsnCEAA.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gosulyri]ImagePath=[%PROGRAM_FILES%]\25A4EDED-1481817057-ADCA-CB81-086266A44A59\knso3ED0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zifyveso]ImagePath=[%PROGRAM_FILES%]\00000000-1440531265-0000-0000-6C626D426354\knss2277.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nevinyqu]ImagePath=[%APPDATA%]\41EA14D1-1432636862-11E0-B16A-41027F19F07A\jnsp2058.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ryveqopy]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1486569038-5110-8048-B7C04F303632\znsu5E29.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486582537-3510-8032-B7C04F525A31\qnsc1F9C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\FEFC32A0-1455771459-11D5-9B38-3085A9918D2E\jnsh8883.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\FEFC32A0-1455771459-11D5-9B38-3085A9918D2E\hnshB32D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\durowigy]ImagePath=[%LOCAL_APPDATA%]\34444335-1428480979-4738-4B53-A01D48E4EDB2\inst966.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pevicyne]ImagePath=[%PROGRAM_FILES%]\03000200-1469020179-0500-0006-000700080009\kns9732.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1486585615-0000-0000-D43D7EF12A58\qnssFF84.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tyqigivu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482908953-3310-8032-B1C04F37334A\kns42FA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\9FA96E40-1460015672-11E1-AE21-386077B048F3\jnsvBBE7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\9FA96E40-1460015672-11E1-AE21-386077B048F3\hnsfDA51.tmp
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\laporte\bean.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1486372475-0000-0000-6C626D42D82A\qnskAD9E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1486430262-0500-0006-000700080009\qnsy8FB8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\031B021C-1486210252-0518-E906-470700080009\qnsc2C6C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486169088-3510-8032-B7C04F525A31\qnsoA30E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486228786-3510-8032-B7C04F525A31\qnsw4ADE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486240158-3510-8032-B7C04F525A31\qnswD268.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopuruko]ImagePath=[%PROGRAM_FILES%]\38464E43-1475689721-3434-5953-001E684802A9\knsqBB47.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\A1847F88-1462420631-11E2-B0DE-001267018052\jnsoB3D8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\A1847F88-1462420631-11E2-B0DE-001267018052\hnsyD37A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486146283-3510-8032-B7C04F525A31\qnsjA8F1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1486160640-3510-8032-B7C04F525A31\qnsxBC37.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\856444A0-1469119097-11D5-876C-00221556F4CF\hnsy4590.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\856444A0-1469119097-11D5-876C-00221556F4CF\jnsu2E2E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\84E64EAC-1485660417-11E1-9658-08107F19C081\qnsb8299.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xyrugipu]ImagePath=[%PROGRAM_FILES%]\C3A87598-1480711113-71C1-9A5B-C4346B498974\kns12EA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\konecyve]ImagePath=[%PROGRAM_FILES%]\C3A87598-1481558190-71C1-9A5B-C4346B498974\knsrED7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hygudivo]ImagePath=[%PROGRAM_FILES%]\C3A87598-1482557002-71C1-9A5B-C4346B498974\kns5CA1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gefimutu]ImagePath=[%PROGRAM_FILES%]\C3A87598-1481777457-71C1-9A5B-C4346B498974\knseD5E.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\betibihu]ImagePath=[%PROGRAM_FILES%]\C3A87598-1482146185-71C1-9A5B-C4346B498974\kns381D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zybosode]ImagePath=[%PROGRAM_FILES%]\C3A87598-1473297258-71C1-9A5B-C4346B498974\knsdDD9C.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xytekyby]ImagePath=[%PROGRAM_FILES%]\C3A87598-1474112041-71C1-9A5B-C4346B498974\knsnF283.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\C3A87598-1471953883-71C1-9A5B-C4346B498974\hnsrA8AA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kefowydy]ImagePath=[%PROGRAM_FILES%]\C3A87598-1440135806-71C1-9A5B-C4346B498974\hnsh6200.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hiduxixi]ImagePath=[%PROGRAM_FILES%]\C3A87598-1479896765-71C1-9A5B-C4346B498974\knsjC9C0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\C3A87598-1471953883-71C1-9A5B-C4346B498974\jnsw76EA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\betebegi]ImagePath=[%PROGRAM_FILES%]\C3A87598-1479985085-71C1-9A5B-C4346B498974\knsi9EC5.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\segudecy]ImagePath=[%PROGRAM_FILES%]\03000200-1446790045-0500-0006-000700080009\knse8917.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fipufuwu]ImagePath=[%PROGRAM_FILES%]\03000200-1446790045-0500-0006-000700080009\hnskBB93.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\90668C23-1486068337-DF11-B59F-00266C80DEBC\qnsxC74D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\CF4D26DD-1476727870-9447-D520-E03F49519A4B\qnsqD73E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rucewety]ImagePath=[%PROGRAM_FILES%]\CF4D26DD-1476707976-9447-D520-E03F49519A4B\knsk6E25.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tetumupo]ImagePath=[%PROGRAM_FILES%]\131B9781-1478329239-11CB-B480-922D0E9D421B\kns8AB0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\131B9781-1485861413-11CB-B480-922D0E9D421B\qnso1C2C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1485779635-4710-8034-B4C04F515231\qnsh95BD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1485793764-0000-0000-001FD0166430\qnsz737F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\CB443043-1485719470-EF3E-EECB-089E01D06A91\qnsiB560.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1485718666-4310-8047-B3C04F353832\qnsc578.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\7B65235B-1485575956-11E4-A961-68F728AB3B12\qnsp3B77.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tulomyfe]ImagePath=[%PROGRAM_FILES%]\D789F481-1474827062-11CB-8ED3-CC054FFD475D\kns2C9D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\D789F481-1475086043-11CB-8ED3-CC054FFD475D\qnswFC6A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1485138997-5310-8054-B3C04F483532\qnsoB61C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wyqonese]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1482736520-3010-8030-B0C04F303030\knsn4CCD.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\09B9724C-1470414206-1220-0705-014148000000\qnsc55A0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\09B9724C-1469385181-1220-0705-014148000000\hnse1A86.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\09B9724C-1469385181-1220-0705-014148000000\jnseE5CE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1451382940-11DD-1690-669910425D29\jnsp303B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1DEBA753-1468267151-11DD-1690-669910425D29\qnsbA2F7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1451382940-11DD-1690-669910425D29\hnsk6300.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1461498152-11DD-1690-669910425D29\jnsr4CC9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\1DEBA753-1461498152-11DD-1690-669910425D29\hnsh1779.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\guvuqigy]ImagePath=[%PROGRAM_FILES%]\809326F6-1477905972-E111-81CA-D48AF65C1965\kns9DAD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\A00D6937-1485405008-5FE7-B8D6-B60B6B0CFD29\qnsx1AE7.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\486F36D1-1484323366-E311-A37A-201A069F5271\qnsw60BE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\038D0240-1485471558-053B-3A06-EE0700080009\qnsw5514.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zyqejiky]ImagePath=[%APPDATA%]\28969F34-1423913473-11DE-BBDA-05EF7BE718A9\nsy3EE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\7A437281-1462993938-11CB-B970-C091C4FF7457\qnsoDCAA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vynutuci]ImagePath=[%PROGRAM_FILES%]\80211A9A-1469890482-4437-9A4A-82DAEB3F378E\kns12C5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\3CD1D54B-1485306638-E04B-ABBA-047D7BD1DD03\qnss1048.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cydunozy]ImagePath=[%PROGRAM_FILES%]\3CD1D54B-1481721431-E04B-ABBA-047D7BD1DD03\knsfFBD3.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zutuzuni]ImagePath=[%PROGRAM_FILES%]\03000200-1451501800-0500-0006-000700080009\jnsqA938.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zizusyju]ImagePath=[%PROGRAM_FILES%]\03000200-1451078112-0500-0006-000700080009\hnsoF3DE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\03000200-1453100357-0500-0006-000700080009\hnsw48DC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vyvyzoti]ImagePath=[%PROGRAM_FILES%]\03000200-1451501800-0500-0006-000700080009\knsn7B2D.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rizyqibe]ImagePath=[%PROGRAM_FILES%]\03000200-1451078112-0500-0006-000700080009\jnsyB27E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\peziqewu]ImagePath=[%PROGRAM_FILES%]\03000200-1451078112-0500-0006-000700080009\knszC22B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\03000200-1463621310-0500-0006-000700080009\hnsv4DA5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\03000200-1463621310-0500-0006-000700080009\jnsf313D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\duwuteby]ImagePath=[%PROGRAM_FILES%]\80211A9A-1469890482-4437-9A4A-82DAEB3F378E\knsDC75.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000011-1483035492-0000-0000-E03F49BF21BC\qnso380.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fizovicy]ImagePath=[%PROGRAM_FILES%]\00000011-1480218599-0000-0000-E03F49BF21BC\kns894A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\43B4F040-1485212588-11D5-8E3C-1C872CC59257\qnsq683C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\94F7E546-1460269692-7348-823A-92DCE3B5E71C\jnss4680.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\94F7E546-1460269692-7348-823A-92DCE3B5E71C\hnsvA56B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\FE0EA01F-1485141114-7859-3C30-A1FEEB12FE8D\qnsu72B4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\2237D745-1484833857-11DF-B7D7-8080470340F4\qnsl17CD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\139F7C00-1485110206-81E2-38D8-50465DE8ACF3\qnsk9BD8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000000-1485106656-0000-0000-001FD0166430\qnsmCA64.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\E4643100-1468656578-81E1-38D8-5404A64C5CA5\qnsc5810.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\C014B4DC-1485097738-E411-85C7-F0761C735C8F\qnspD117.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dovufosy]ImagePath=[%PROGRAM_FILES%]\69C4405D-1478848998-E311-A34E-208984FEE8BB\knsnFE26.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucihivu]ImagePath=[%PROGRAM_FILES%]\67112500-1450165936-0920-1212-031204000000\knsa2907.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fedytuni]ImagePath=[%PROGRAM_FILES%]\34363965-1480158142-3536-3036-705AB6F3CF2B\knsoA993.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\1F459200-1484987069-81DF-3313-BCAEC5123316\qnsp7F8D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\DE7F63F5-1484953410-11E4-A818-28D244E877A5\qnsn4B99.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ponuqesu]ImagePath=[%PROGRAM_FILES%]\03DE0294-1482585690-05DC-0A06-670700080009\knsFEEF.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\6A9269F1-1484908531-694E-9556-0C5223EA5FA1\qnsa80FE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\piroxine]ImagePath=[%PROGRAM_FILES%]\9CB2482B-1482081979-11DE-BBD8-7D531FB30023\knsAE96.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\9CB2482B-1466556356-11DE-BBD8-7D531FB30023\hnskC3A2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\9CB2482B-1466556356-11DE-BBD8-7D531FB30023\jnsxA4CD.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jozyzoli]ImagePath=[%PROGRAM_FILES%]\E7A80380-1473770124-81E1-3393-3085A9185DC9\kns9A80.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\votyhose]ImagePath=[%PROGRAM_FILES%]\5BEF89E8-1480751237-11E0-9F61-4145CC962C1F\knsD2DA.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jihexyke]ImagePath=[%PROGRAM_FILES%]\5BEF89E8-1480866830-11E0-9F61-4145CC962C1F\knsF7A9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jedufuqu]ImagePath=[%PROGRAM_FILES%]\5BEF89E8-1480744700-11E0-9F61-4145CC962C1F\knss520A.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1480428074-0500-0006-000700080009\qnse602E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jucosuwe]ImagePath=[%PROGRAM_FILES%]\03000200-1480402757-0500-0006-000700080009\knsk5BD7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1471371893-5710-8042-B4C04F525831\hnsq148C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dyqimyje]ImagePath=[%PROGRAM_FILES%]\07E63B5B-1481998796-11DF-BB29-1C81B300405A\knso6E20.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\AAAAAAAA-1484657159-AAAA-AAAA-D43D7EE0D2C7\qnsu1D4C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gymoleko]ImagePath=[%PROGRAM_FILES%]\B0156226-1481880498-E211-8E5B-6C3BE59053B0\knsj5E21.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\EED08878-1484058831-1E40-B502-047D7B1DB3BC\qnsa8FA2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\debipere]ImagePath=[%PROGRAM_FILES%]\77164D14-1480504751-11DC-BBDA-C4F2DCB6001C\knsmAFE7.tmpfs
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]dutoauto="[%PROGRAM_FILES%]\nannies\croats.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Commonplace\parham.exe"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]rutoauto="[%PROGRAM_FILES%]\nannies\dismissals.exe"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]interpee="[%PROGRAM_FILES%]\Commonplace\parham.exe"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\motukily]ImagePath=[%PROGRAM_FILES%]\13B45D78-1475321382-9F4E-D6EB-54A050E83576\knsvE861.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lucibity]ImagePath=[%PROGRAM_FILES%]\672FC64F-1479687954-E111-B40E-B888E3636561\kns9E6A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fikidihu]ImagePath=[%PROGRAM_FILES%]\672FC64F-1479687954-E111-B40E-B888E3636561\kns5194.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wisukecy]ImagePath=[%PROGRAM_FILES%]\01321DD1-1449172578-CB11-A44F-A58D2F67C0AD\knsqC0D1.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\povopilu]ImagePath=[%LOCAL_APPDATA%]\01321DD1-1449179832-CB11-A44F-A58D2F67C0AD\snst6441.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fulewedu]ImagePath=[%PROGRAM_FILES%]\01321DD1-1449172578-CB11-A44F-A58D2F67C0AD\jnsoB8A5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\digisudo]ImagePath=[%PROGRAM_FILES%]\01321DD1-1449172578-CB11-A44F-A58D2F67C0AD\hnsoCF33.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lomuposo]ImagePath=[%PROGRAM_FILES%]\C45A7700-1475458828-944B-8C15-089E013FBD73\knscF683.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gekohoru]ImagePath=[%PROGRAM_FILES%]\A8D414A5-1482000323-E211-A25E-B888E3B9A28D\knsE1AE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\F280D780-1470453634-11E2-878C-089E015C9BBD\hnsh3075.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fyxityro]ImagePath=[%PROGRAM_FILES%]\F280D780-1470453634-11E2-878C-089E015C9BBD\knsp121F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\F280D780-1470453634-11E2-878C-089E015C9BBD\jnsgF556.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1484270986-4210-8046-CAC04F5A334A\qnss5CC2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rocufyky]ImagePath=[%PROGRAM_FILES%]\23FC9A40-1459687978-11DD-9AEA-305A3ADF9C6B\jnsrC5ED.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\23FC9A40-1459687978-11DD-9AEA-305A3ADF9C6B\hnsrDD65.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1484295263-4E10-8059-B1C04F483132\qnsiA2DC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\4C4C4544-1483999649-5310-8047-C3C04F383132\qnswB68.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\2197C180-1437049191-11B2-8000-DBE4622636D8\snsrAAA3.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nuxodiru]ImagePath=[%APPDATA%]\00000000-1430148426-0000-0000-448A5BA6F296\nsf59BC.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bodocifu]ImagePath=[%APPDATA%]\00000000-1430148426-0000-0000-448A5BA6F296\jnsaB115.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\B7203793-1484172465-E211-A324-208984E59796\qnsi8A52.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\038D0240-1483788481-055B-4C06-560700080009\qnsrA6FB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\6EACFFC0-1484230934-E411-85C7-F0761C8571B9\qnslABAB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\ECF59000-1484056847-0000-0000-000000000000\qnsw2292.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dumedope]ImagePath=[%PROGRAM_FILES%]\EE1A6E3B-1476368883-3945-2BAD-7B80C6ABF857\kns56.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zyryceji]ImagePath=[%PROGRAM_FILES%]\EE1A6E3B-1476368883-3945-2BAD-7B80C6ABF857\kns5C44.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fisojoji]ImagePath=[%PROGRAM_FILES%]\EE1A6E3B-1476368883-3945-2BAD-7B80C6ABF857\kns1C3C.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rudymexe]ImagePath=[%PROGRAM_FILES%]\03AA02FC-1453170990-05E5-3906-140700080009\knsED2D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\BBF80539-1482373399-974E-8A26-4EC73AD130AC\qnszA40F.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\20F42F65-1484100970-E211-A322-208984E09540\qnsv9EC9.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\F8FA4F29-1483940915-FF4C-83DD-1F28BEB3EB56\qnshC345.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%SYSTEMX86%]\config\systemprofile\AppData\Local\8F655F20-1483912493-11DD-944E-60A44C25973C\qnshE1B5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tebyqigu]ImagePath=[%PROGRAM_FILES%]\03000200-1482914325-0500-0006-000700080009\kns27EE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1483885263-0500-0006-000700080009\qnsj25C5.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyhiryto]ImagePath=[%PROGRAM_FILES%]\33444335-1482154886-5330-3754-A45D367BF5D6\knsnF7ED.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\meguqysy]ImagePath=[%PROGRAM_FILES%]\21B404EC-1478188445-E511-A26A-308D9977082B\knsf8762.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roboqego]ImagePath=[%PROGRAM_FILES%]\DC8125E5-1483751098-572C-1C80-001E8CE97FA5\znsx4280.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\covoqujo]ImagePath=[%PROGRAM_FILES%]\E8FC6300-1482556514-11E3-A21B-C03FD5650B96\knseB9E2.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\EF06F480-1483752370-1012-9C4F-99EBABAAB803\qnspDC3D.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\solywucy]ImagePath=[%PROGRAM_FILES%]\03000200-1482108263-0500-0006-000700080009\kns3FB0.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1483795107-0500-0006-000700080009\qnsc34B8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\0A36E040-1483722024-11DB-A715-001BFCB14C99\qnsq4616.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\91521A60-1483725034-11E1-87AD-20A0651475BF\qnsw55FE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\boxexycu]ImagePath=[%PROGRAM_FILES%]\91521A60-1483414462-11E1-87AD-20A0651475BF\knse3B22.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wucotusy]ImagePath=[%PROGRAM_FILES%]\3FE91380-1457933865-5874-97B0-305A3A0EC47B\hnsm2514.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rowugoqo]ImagePath=[%LOCAL_APPDATA%]\3FE91380-1457959438-5874-97B0-305A3A0EC47B\snseE6EC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\70757DCE-1472533451-36F0-9AD0-F079595AC1B9\hnss4E04.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dowidoly]ImagePath=[%PROGRAM_FILES%]\70757DCE-1472533451-36F0-9AD0-F079595AC1B9\jnse205B.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\00000011-1483610370-0000-0000-50465D9B6A9E\qnsiAFFE.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nyqigopo]ImagePath=[%PROGRAM_FILES%]\8FCC2DCC-1483368148-11E6-8D30-5C2C09521C00\knsrBEE7.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\611931A1-1483387304-A845-8550-49F86AEDACEA\qnsc4134.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tocyfori]ImagePath=[%PROGRAM_FILES%]\CC29F313-1483436008-11DF-8B22-6EC0590080CF\knsD49E.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hyverumu]ImagePath=[%PROGRAM_FILES%]\03000200-1437981140-0500-0006-000700080009\jnsv1BC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wunizyko]ImagePath=[%PROGRAM_FILES%]\03000200-1437981140-0500-0006-000700080009\knss4F65.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gopibeko]ImagePath=[%LOCAL_APPDATA%]\03000200-1438000993-0500-0006-000700080009\snsk97F4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\comyninu]ImagePath=[%PROGRAM_FILES%]\03000200-1437981140-0500-0006-000700080009\hnsn2014.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hepiwope]ImagePath=[%PROGRAM_FILES%]\00000000-1483351463-0000-0000-1C6F65E1FA89\knsgEFD0.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\15AFCA0D-1483558903-E311-B064-F8A963716139\qnsr48AB.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\03000200-1483563141-0500-0006-000700080009\qnsq25A4.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cyfemeze]ImagePath=[%PROGRAM_FILES%]\543C9E1A-1476190074-11E3-B767-A088BF0C60DA\kns5F2A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jymibike]ImagePath=[%PROGRAM_FILES%]\CA6CBF51-1477509259-11E4-A26A-F0761C698918\kns9227.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zigipyro]ImagePath=[%LOCAL_APPDATA%]\CA6CBF51-1478091789-11E4-A26A-F0761C698918\qnsi4CB2.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\josojosi]ImagePath=[%PROGRAM_FILES%]\42314331-1483401028-3134-3935-4134FFFFFFFF\knsvF421.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\guwulutu]ImagePath=[%PROGRAM_FILES%]\36367E75-1482572464-11E5-8B16-F0761CF1480E\kns3EBC.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\boxexycu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1483421011-4310-8043-B7C04F574E31\knsv8B17.tmpfs
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sikyheko]ImagePath=[%PROGRAM_FILES%]\D87F6850-1483141712-11E2-AFF6-3C077165FEE2\kns6A77.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\myfejozi]ImagePath=[%PROGRAM_FILES%]\D87F6850-1447869919-11E2-AFF6-3C077165FEE2\jnsqCA9A.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jopesucu]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1474754285-4710-8050-B7C04F5A4E31\kns79A8.tmp
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rijufoze]ImagePath=[%PROGRAM_FILES%]\4C4C4544-1472595375-4710-8050-B7C04F5A4E31\hnsv8E89.tmp