qualcuno di voi riesce a capirci qualcosa?
GMER 1.0.12.12086 - http://www.gmer.net
Rootkit scan 2007-03-12 10:29:47
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.12 ----
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys ZwAllocateVirtualMemory
SSDT \??\C:\Documents and Settings\T&T\Dati applicazioni\hidires\m_hook.sys ZwCreateFile
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys ZwCreateThread
SSDT \??\C:\Documents and Settings\T&T\Dati applicazioni\hidires\m_hook.sys ZwEnumerateKey
SSDT \??\C:\Documents and Settings\T&T\Dati applicazioni\hidires\m_hook.sys ZwEnumerateValueKey
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys ZwMapViewOfSection
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys ZwProtectVirtualMemory
SSDT \??\C:\Documents and Settings\T&T\Dati applicazioni\hidires\m_hook.sys ZwQueryDirectoryFile
SSDT \??\C:\Documents and Settings\T&T\Dati applicazioni\hidires\m_hook.sys ZwQueryKey
SSDT \??\C:\Documents and Settings\T&T\Dati applicazioni\hidires\m_hook.sys ZwQuerySystemInformation
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys ZwShutdownSystem
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.12 ----
.text tcpip.sys!IPTransmit + 10BC EBECCCFA 6 Bytes CALL F8360C20 Teefer.sys
.text tcpip.sys!IPTransmit + 2810 EBECE44E 6 Bytes CALL F8360C20 Teefer.sys
.text tcpip.sys!ARPRcv + 506D EBED34E0 6 Bytes CALL F8360C20 Teefer.sys
.text wanarp.sys F87AA3FD 4 Bytes CALL F8360D70 Teefer.sys
.text wanarp.sys F87AA402 2 Bytes [ 90, 90 ]
---- Devices - GMER 1.0.12 ----
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F86E6220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F86E6480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F86E65A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F86E65D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F86E6220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F86E6480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F86E65A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F86E65D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F86E6220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F86E6480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F86E65A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F86E65D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F86E6220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F86E6480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F86E65A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F86E65D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [F86E6220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [F86E6480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [F86E65A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F86E65D0] wpsdrvnt.sys
---- Processes - GMER 1.0.12 ----
Process C:\WINDOWS\system32\hldrrr.exe (*** hidden *** ) 544
Process C:\WINDOWS\system32\hldrrr.exe (*** hidden *** ) 576
---- Registry - GMER 1.0.12 ----
Reg \Registry\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global@Microsoft.MSXML2R,publicKeyToken="6bd6b9abf345378f",version="4.1.0.0",type="win32",processorArchitecture="x86" L%wzz@=75Aw!Z~WLW(xZPlatform>ITzaC}zyQ@Zq3QlMCb0e?
Reg \Registry\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run@hldrrr C:\WINDOWS\system32\hldrrr.exe
Reg \Registry\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run@hldrrr C:\WINDOWS\system32\hldrrr.exe
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserDefaults@H:\\?\IDE#CdRomDVD-16X_BDV316C_________________________.19G____#5&1a3c7cc5&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayDVDMovieOnArrival MSPromptEachTime
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserDefaults@H:\\?\IDE#CdRomTSSTcorp_CD#DVDW_SH-S162A_______________TS01____#5&1a3c7cc5&0&0.1.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival MSPromptEachTime
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserDefaults@H:\\?\IDE#CdRomTSSTcorp_CD#DVDW_SH-S162A_______________TS01____#5&1a3c7cc5&0&0.1.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayDVDMovieOnArrival MSPromptEachTime
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:S:\QBPHZRAGV\Zbqrz nyvpr 3002G\qyvax302gHFO\frghc.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\NQFY 302G\Qvfvafgnyyn zbqrz NQFY 302G.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:Pbyyrtnzragb n Pbaarffvbar nyyn ergr ybp 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:nyvpr.yax 0xB0 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\jfphv.pcy",Prageb fvphermmn CP 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Nvqn 32\nvqn32rr_390.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\NVQN32 - Ragrecevfr Flfgrz Vasbezngvba\NVQN32.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\NVQN32 - Ragrecevfr Flfgrz Vasbezngvba\NVQN32 ba gur Jro.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\NVQN32\nvqn32.rkr 0x7F 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Npprffbev\Oybppb abgr.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\wer-1_5_0_09-jvaqbjf-v586-c-f.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\Nmherhf_2.4.0.2_Jva32.frghc.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\iyp-0.8.5-jva32.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\rZhyr0.47p-Vafgnyyre.rkr 0xA7 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\rZhyr\rzhyr.rkr 0x29 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\ehaqyy32.rkr 0xA8 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qbphzragv\Zhfvpn\JvaEne-VGN i3.50 + Penpx\JvaEne-VGN i3.50 + Penpx\[Svyr q'vafgnyynmvbar]\JEne350vg.rkr 0x59 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qbphzragv\Zhfvpn\JvaEne-VGN i3.50 + Penpx\JvaEne-VGN i3.50 + Penpx\Penpx cre JvaEne3.50\Trarevp_Penpx.rkr 0x59 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\jvanzc531_shyy_rzhfvp-7cyhf.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\ZZFLF.PCY",@0 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\vafgnyy_synfu_cynlre.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Bhgybbx Rkcerff\zfvza.rkr 0x3F 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\ABGRCNQ.RKR 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:::{645SS040-5081-101O-9S08-00NN002S954R} 0xA7 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\TznvyPbasvt.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:Cynl CXE.yax 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\CXE\cxe.rkr 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\nccjvm.pcy",Vafgnyynmvbar nccyvpnmvbav 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\cxevafgnyy.rkr 0x66 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Zrffratre\zfzftf.rkr 0x07 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\Vafgnyy_Zrffratre.rkr 0x07 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Nqbor\Nqbor Qbjaybnq Znantre\Nqbor Qbjaybnq Znantre.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\NqorEqe708_vg_VG.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:Nqbor Ernqre 7.0.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Nqbor\Npebong 7.0\Ernqre\NpebEq32.rkr 0xA2 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Pbyyrtnzragb n QveYvfgre.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir MRA I Frevrf (E2)\Qvfvafgnyynmvbar MRA I Frevrf Zrqvn Rkcybere.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir MRA I Frevrf (E2)\Thvqn qv MRA I Frevrf Zrqvn Rkcybere.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir MRA I Frevrf (E2)\MRA I Frevrf Zrqvn Rkcybere.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir Betnavmre MRApnfg\Betnavmre MRApnfg.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir MRA I Frevrf (E2)\Znahnyr qryy'hgragr.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Znantre qvfpb evzbivovyr Perngvir\Znantre qvfpb evzbivovyr Perngvir.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir ZrqvnFbhepr 5\Betnavmre Perngvir ZrqvnFbhepr 5.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir ZrqvnFbhepr 5\Yrggber Perngvir ZrqvnFbhepr 5.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Perngvir ZrqvnFbhepr 5\Perngvir ZrqvnFbhepr 5 Nhqvb Pbairegre.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:Ertvfgenmvbar qry cebqbggb Perngvir.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Perngvir\Ertvfgenmvbar qry cebqbggb\Vgnyvna\VargErt.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\uqjjvm.pcy",Vafgnyynmvbar uneqjner 0x0E 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:R:\Frghc.rkr 0x24 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Cebqhpg Ertvfgengvba\Qrggntyv fhyyn ertvfgenmvbar qry cebqbggb.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:MRA I Frevrf Zrqvn Rkcybere.yax 0xA2 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Perngvir\Cebqhpg Ertvfgengvba 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\JVAQBJF\uu.rkr 0xA1 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\QveYvfgre\QveYvfgre.rkr 0x9E 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\VafgnyyFuvryq Vafgnyyngvba Vasbezngvba\{7P9S6NS4-R9Q9-47SR-OR4O-R637P2SPO410}\frghc.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHAPCY:FLFQZ.PCY 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Jvaqbjf Zrffratre.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\ZFA Zrffratre\zfazfte.rkr 0x9D 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:{SPR50QO8-P610-4P42-OR5P-193S46P6S812} 0x06 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\wcvpcy32.pcy",Wnin 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Vagrearg Rkcybere\vrkcyber.rkr 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Jvaqbjf Zrqvn Cynlre\jzcynlre.rkr 0x93 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Nmherhf\Nmherhf.rkr 0xAA 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\Fbhgu Cnex f1r1-13.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\fbhgu cnex.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\JvaENE\JvaENE.rkr 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\OFcynlre.Ceb.i2.0.0.937.Zhygvynatntrf.Vapy.Frevny.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\Zhfvpn.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\Frevny.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\Frevny (2).yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qbphzragv\Zhfvpn\OFcynlre.Ceb.i2.0.0.937.Zhygvynatntrf.Vapy.Frevny\ofcynlre_ceb200.937.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Jrogru\OFcynlre Ceb\OFcynlre Ceb.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Jrogru\OFcynlre Ceb\OFcynlre Ceb pncgher.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Jrogru\OFcynlre Ceb\OFcynlre Ceb fhogvgyr rqvgbe.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Jrogru\OFcynlre Ceb\Havafgnyy OFcynlre Ceb.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:Zhfvpn.yax 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\IvqrbYNA\IYP\iyp.rkr 0xAD 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\urebrf.101.uqgi-yby.[IGI].yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\G&G\Erprag\Urebrf.yax 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\Frghc.FgernzreBar.Orgn031\Frghc.FgernzreBar.Orgn031.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\FgernzreBar\fgernzrebar.rkr 0xA5 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\Zrqvnpragre0.4Frghc.rkr 0x01 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Zrqvnpragre\Zrqvnpragre0.4-ol Pbbyfgernzvat.rkr 0xA5 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Jvanzc\jvanzc.rkr 0xAA 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Npgvivfvba Inyhr\Jbeyq Frevrf bs Cbxre.yax 0x02 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Npgvivfvba Inyhr\Jbeyq Frevrf Bs Cbxre\jfbc.rkr 0x02 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\pyrnazte.rkr 0x02 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:::{208Q2P60-3NRN-1069-N2Q7-08002O30309Q} 0x36 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\qrfx.pcy",Fpurezb 0x50 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\qverpgk_bpg2006_erqvfg.rkr 0x03 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Zvpebfbsg Bssvpr 0xAB 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Zvpebfbsg Bssvpr\BSSVPR11\JVAJBEQ.RKR 0xAF 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\DhvpxGvzrVafgnyyre.rkr 0x04 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Cebtenzzv\Zvpebfbsg Bssvpr\BSSVPR11\RKPRY.RKR 0xB0 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2% 0xA1 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qrfxgbc\rcfba4970rh.rkr 0x05 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Rfrphmvbar nhgbzngvpn\R_FCFH01.yax 0x05 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qbphzragv\Zhfvpn\[CP NCC - VGN] - Cbjre QIQ KC 6 Qryhkr I.1.1.02\[CP NCC - VGN] - Cbjre QIQ KC 6 Qryhkr I.1.1.02.rkr 0x05 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\G&G\Qbphzragv\Zhfvpn\erohvyg.Erny Cynlre i10 TBYQ VGN + penpx\Erny Cynlre i10TBYQ VGN.rkr 0x07 0x00 0x00 0x00 ...
Reg \Registry\USER\S-1-5-21-2000478354-1677128483-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count@HRZR_EHACVQY:%pfvqy2%\Erny\ErnyCynlre\ErnyCynlre.yax
Registrazione