#1（17.10.24）

petr0vic

https://elementale.xyz/wios

https://transfer.sh/eOcaF/1.7z

infected

https://www.virustotal.com/en/fi ... 06c8875a7/analysis/

zst470396853

360

欧阳宣

BG双击回滚
Drop.Win32.RoamingRun.5364

1. Files modified
   
2. •    C:\Users\jeff6\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LKGV2DXW\home.mcafee.com\AppSupport\Common\Secure\Notepad.tmp
   
3. •    C:\Users\jeff6\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LKGV2DXW\home.mcafee.com\AppSupport\Common\Secure\NativeCache.exe
   
4. •    C:\Users\jeff6\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LKGV2DXW\home.mcafee.com\AppSupport\Common\Secure\TranscodedWallpaper.kev
   
5. •    C:\Users\jeff6\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LKGV2DXW\home.mcafee.com\AppSupport\Common\Secure\Control Panel.kie
   
6. •    C:\Users\jeff6\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LKGV2DXW\home.mcafee.com\AppSupport\Common\Secure\Notepad.zup
   
7. 
   
8. Registry modified
   
9. •    HKEY_CURRENT_USER\\Software\Microsoft\SkyDrive : Giekav (old value = 4C2CAEECF8A634EA25573D285086DD95E237E9FDC9C14212829C870528A5E40B06A1132164966B1714FFF6D6A44841A8E50A3879583727EAE6F795771D6AD0F27CC3CA1AC94F540D1FFD5EF51E1B3AA4532FF6018B56600A79C0071D679D370A5DEC34E5D6A6BED051D939A59DEF8063108A009FA8FCB4E4EF61528CB141BAE5B7A5B8B6338380C157D663DC082CB9A9F99751D3DEBAF099F03FF45D1971B0D0407336936A47AA0CF4AE7664430AC6657839F1FB35E21BB7A394C07BA6A5E744598B448DBA09BCA94B6B970FF9B245A302A28E01491F34E14376B11F496B54B6AA3FD08AAA8750FA26324D5B4BBB85F9D0D4090086EF9941649B01BB93B346F68710CFBFCFB0696B7A85BB4FC237B291444AC540183B95E741A49832FBF21A38423C3DCFC1B66ED20BA010E2474A639E87E6CBC27486BD10091E3A95F148765A83D9CB5D6161158589D37D690F26E69C39C8AC8A38C88E0BE42BF97AC318E733A9DFAD68D54789B4602A8291369B63F84B9234E5140465422395F8E6CA72BEC11A613A833BCB0311333A6DBF6D6A94641E454B6C50D349CB385BD24E954E749A30046AD04F122E1E9E16CC403C41EF0B4519FAB859CFC793AB300D9723394A77D566D7EFB44F9CAE2274E71D5BC8AEA7F63D7932300B2D79FC34482FD656A779695D106F63B411C94D6761C7893D44993176DC9607B08C117061169FFCBE72350A1C995FBCF34C2075C122F8035B235237ABE64CCC9ECFC9F0F04ACA14138AB5862C688A72A94C6D892C1618E43A8834A8161DEFE74A46A41EE757E9DE46E464E5B4FB647B2AE408699CBE29C72ED2996DEE277AD67733EA7D7FD0119A20A8A32E6582E483D7D038817F75B9E75A57CBD23C738889442DC50431B312150BBF6F697939D46586E5B02A024EF3EBB810F290D7B9771BE65C75FB6914BE615933FDF6040778CD90C42242E53DC59D3EF692B3EAAB66C95ECD0FA62D74F5F630A4AA0FB46E175494F931EFDC34191354746F26A40F18B7BDE0EFE3C85BCCD7151106EE8565100F35C3747193FC42C443F606802C63C4E7E29091D9C46148A14F9893C0B79860DD981C226A092FF15F0548A93BD838A6E69233DB0800635E803E5DB3992182357CBFC78E557708F476064F1B0303C9B4A68E49C23E290D03E5A289DE7257FA7C3CBD486A65173ED7497A07AB229DF32CED3B25FA11AB48D1E8F3E933D8CE57C78CC9BA76D421068DD4D97A5DB9A59460F948B4D1EAFC73E05B463B001E3EDD55707AAB25A06EEB7993377837102463356CF8142FD0EC22F4C9CBBE0AADB3E68E9052B78ED8775B9E549DD75B571E8806D95F4F3463F9C15C1AF0CD72A753F38C7CC95EC9213DF1C5D91484CFF63DFAD7F2F04BB64E58829576341F201C2710D6F806B18257D1AA5FF063D5AD734C69DFA00781C516B99B853066C9D58DCEF69E3E78A02596611E93009128B0541D3882279855B020C1E8FC9970585C12A2C652E0F7C652FEEF85E3B4B02BC3B9C45CB98586391523D61773FC7EE6A374DEC7CC8FFC8005DB95DA8F2202260F7DD891CFC0511BA2A1543272370B48C142182A6C1E71BEB9E39A382F1641F11592FC47477BD7F70422AEFC4D904EAAA4497EA311AA37CE9B2E3997C7288159539CAD6C1B8FECA56FC85B1FD0EB47C269048F865AA2BD46403E2E1A953D88C4545960332A7AE115E254455AE3423EC8DEC1666979AFA02D2D8E188072908F8981ABB9D66A280B29481119501089B1C2485915D6E1A29CB90F5F746F3B0395788BC1BC6433396BF1100F5E0CAFA12264F9E1D6E82E9E8BE770C81D7E3A75C4FC5E0704529298F68D5ABE649B69ECF9F3E60AD4D6883E7201BE0E11A53428CD46EDECB650DB92C53D5D6815681A0C77FCFBA906B3DDBFDA5D8551C0827DA9B27223BAB4D87EE30D513F8AC7D90F770B168AFFB6F2B15C2A98AB6E4DA2396DC5443B57CCD9E6E07133FEB6889082A95078B1C58D6FE1299FA0F6A1DD7032B102518F9461AC2157C83E2113CC00E1F9104597A64D32C9D0FBA498EE7973CE252A54EC086F0CE4299BF61F1E58B614EA41AD704F2CCA39462958F47A8FAF5EE80BD918FE0BE5F95409C1E32CCEFADE97CC74027C320DA247A60269CBA66EAC2D95BCFC19D6C53D19055FD7EE8D43346B44613365BD91367CC822F914F19EAA1F7281D2E8A93C5BBBE8F584E65C683A74F025D46A37C4802D70FEDC48C28643DAF1A4CD1F080216883B8608392562A2B56EFB914C15E1CD212D1E96570690066A7B984BF9D9E001F8D38A398310F9368E7C84E947735F2AF58D4411655A20D7D67CBC152A183D358B491DD31EEEE7E14DC49E3FEB12965B70EEF5243A82D7190A61146916A408131E9A8976BD0C125F7B6332A55F3AC5E5BA8316981B973157785EF2B4D4096D02E7D607D3AE7C9A96AF4512DABA6908363C0BD49DCC82A8361372AA89E70737B2C081DA3CC4E4DDB3AE61426C143F9E96EF55F3FD4E2F74696A7A80E1 -> new value = 26474D7375F5053D0C25DB94D0F87AF477E0BAD82FFF8E5F018FBC6A4597B0FA123964AF4E2FA5F08335AA841AC4D2D863A79AB076B45DBD410CF81AEB1D13DF7F0584CFDF487B5562E378CD7225E990F4413706B8C45476218862A724AEB56EF42E9E9D0258FA4FEA10B59C147709CC254726AD3D85282E0CC5649C421181E869F33439D230F1BF5FDFDC345E3D22E4AC5AF62EB9ED74411BC03B565942838E3796B41CBB9571F0899A4EAA4DA2024718156DC93D955CAFE80896DD311BAB388BB72208F3257BC8D5CFA3CA100F094A2F894CE6F888D8458BC7CF9E42CAC124FD0CCCF4FDCC11D789912BCEA18218EC496748232C37B933C8ED975B8B14ABD3B419B7C4D4F9CBE98B0FA0597AED9C8C1EE9375A1185B7B935AA02219E6EBCE35DA9D4E5F0A121DDC4418B3CD3B9D9F79C858822EBC2971BEF8CC0BEA92AC0DC4D5A3195B1456A398FAF66C1D74FB6268B91E796933E261E25EECED81E45298F47D3D696C7526BD045233AB3B6DC7914E384EEF63B651F09680E5637AEBA2E5B87A72C9AB3825F1DDB3B3D7D55585B09BB06FB3D5C6E4A627A92A8EAD9A07AFB8A9F0D26BC35DDB2C10F3E544EC5CC0CDCCD606C8163B8664350F2E2C3658931E205C5BB511A98B539BD60453CD37A50CD669EB54462DEAD54FF61B4A092F0BD2EBE889C1B8332298B81C3896C3B1E1A75D25207C597163417229CAAF6CE5709726E0E4D5C3FA7FBA5B53D4F71FD977DB784A420413ED6C8023D1B383B0B228A931BCFAFDEB7FDEB2959BCBF7DA12EE28FA89789AA6D52DBDB438BF89D701252F1A38C87AA993862DA0AA9DF427398F84BCA041B748DB1B62D6F7E54A53B28A5B8CEEF13CE86251D34F5DECE2B3050EA4ADE6257D0C19419F03A2B73885A398FDEBEFD694819462ED705D158E41064C943075E14EEF4AD06A0A024B7B0D1F421C83775DC8F8C6CD68A5C7CB655404519BE1D2792049C01F183658D4CE6C3B32314E4D7CA336265167E914F6779D02FBB3CBC1DFC42EE1AC06A911F86B3688F27607B42EB8FE3D8330CE695887166049BF97F8DF213C9BA28533C666719297FB16A2D0ED6A499833AB261DEB56E9DC0D2D8BD0797106C2B10AE051FB5F016B309C1D3A2E7FE66D781B7E74EEA5E16E355AC1359568982EDE19C532A65EDCA472D76ABF8248CA862DA131559DE56967C8BB8AFCBDA4F866C0A81A846ED087BE2048DC86B2542B940DD78B43F9A44032A66A9849B3CA8BE6F69024B68A44CDD62AC67C76FA49FCE945787DD22C3F2D75D9401716F829717C7230C1EE8AF2B3A42CE32B41C41CC43D9035521483F5819BAC6EA453E637DF0EF13A1DB37B2C2DD8593264801A8C92050033CD2E58716F022E77C15B5E26D18D94773080BD0E03594D0A1FE3AA2DF2C9F0CE2CDEF8BEF46FD063B41EFF22B00DE0A578D1372D69D2BE014F430DCE7DF60407C44D7A9807F9F9FFD8BD7359E916A6B80BB1018F3FF6D7BE66FDD3251FFCE550A0DC5A7A028ED23F5CCD6444C8C2EAE0597EA0B2CC70E69AD275A451376C53D2A9B560BB6B1199674444CA746BB49068DA44AF9F21A9A86A0808682FAF23582CC7FB74E2CA90AB1F440C9D0E0BCAAC2672DF8F7B03EB6313592F29F6DF812DB78CF4C27ED07BD7D56F9C02F9A4A699FA3237AE157B29365ABB02D4AF0FA9DAA2B943F9B0B649EEF678D057CC8786B619925D08600781DD690AC62B609FD5207F1D1117093C604AF89374DD621C7986040414A05F73C0C8CFF4E738013057A4A353A327A955592AE14C25BEA9FBE46E1DC6626EC666425ED626FAC2621EC2E7A63319394C3CBEF03B4E65D6930BBBB9D14B8EC8DB8724048F815C2490D3029D5CBC4705918D805233284074837B6A17F05DB74D48A4289DFDAB736B6D271083BCE6D51209968BC0C925308B7172544C5AC011F25974A6E4ABA0A221BC8225E33B4464902F4E303BD78E6C26DC72479F7098C8A115FA0DA5B8008FB308E06FDA9B3DD259BB2B2883DEB16BC7A544C50A5601F9951183B105BCE0BD98B23687094F6E8D4508E248F9A4454E002F1A9CEDCAA174409D89F482728F97C542B6AD6F7B31475333881D7E5BC69D8AA884A13D8CC8EDC5DACA79160BFE2B8C3D041402AF1A2E48D42A5538FECC365AD2A83F41338FBBC2715736E28332F5744F9E07DBE238AA6FFB725E2933D86C5835EE137871F932526E636D6D45FBF5BD3E290DF897DF4DAD295E996BB41CE6B33AEC52971655C21D5E2252FDE4AF5A21C47B1FFA99A0116B32A28CC2AAC8AA3AC541966D29E57C633FF05D58ADB78152C3E723348C9538F8578BD174F5F4B5557833791985F0BF10083C9542C424DFEE312CBB76983F21577AC40AA2A497428A2057CC9E753F902837F0346DA3D8DA12F2E0F7378DA8E48C6DA7FDCF972D87D019079F8525CC19CDBEFB2F9127939015B2464D14477644B2EE5247D907E0B8CE1382993D8D7E6567B3C094CEA5117ED80755EE869E0A10EC1E43EE305)
   
10. •    HKEY_CURRENT_USER\\Software\Microsoft\SkyDrive : Giekav (old value = AAB4ACC8CCE7F90AF80EA888665948D654BF6E9457A937F4E2402A8E948566FFE51340B8BC45311D1EC9D3B34A83E650FA746EE563BC4F01E2A02EC4BDBC8B11C4F5B6FAD9EB7638E1787296E0264667C887733BDCBDDBE0CB08EDCDFD4BB1410A730B0591130C88E9EB32E01A7A3792DA741928B6453E711D13E5362F9AAA4EB31394BB1D9DD7E63EDD6619355900B068826F88397ACD7AC60E3D5E5226B0DE332F4E2B06D621CEAD7F7018CFCAFD91A506035E7EB8C77DA766DDAE29E12D3AFE8F52FD5669BD132A7017AE1EF8E30FCF17A7D4EAF5AC6F042E25F222878258A7BDF851831408508D0E34C886C18F8FBFE419000DE09FA958E1E94EBB5705D028498D2EC9F0FB74C58E4B20BEEA08D787FAC616C5E63C77951E310ADE38BCF3B4DA295520E60C13292A2F84246101569BA6D2F97415FBE8611D9CAC38CDE5898F28D6C53E003626AA08862C73A8CAB440ECF087FBE6B3187B3ADCCAD03C75D439C400ED71B4EFE1A9C34B5A0C4A14B2F827456D0981519D537F714AA1567CB731D435C6233C728FDC0687C8D38EAA4E2DF683FE4334E4AEF92CF46B74BA7EFF40C1A29200DB233420373C4A01E47BE62F34CDC691475265A1FAC27C7D4BB89E32D484F4FD7D0C117F9DB0B1376ABDCC09CA7991407F1AD1D4F7AC453DB21876464ECAF84D667E1AF1A7517B1EDE8694DC6184D82C57DE05B7F2ED24F5133D40523A1D72740A4ED33169B4DA9F8340F63CBE122A9E9E38C7CBC9B440449E5CBCB8875527E549EBCA5F097B2C505057051C3FB5B1A7E9D3E40D1596AFF5C76C14ECC2E2EEDC3D06057274363BD07F5AE7C437E9D056C7C289CA15D75BB6B1B72D8876C869F224D88800C466D5A8D92A950352D447E53C0F17BC8F14A409A77A82DC76521D6B431DBDF9B28F58B44A909EE3A3F8456B67D727ACCD43049916C2AB8647FE08E7C0925B430B43DF9A79D0F530647743659D150F8E84CFEBE6B752B0F489975E2A2AF6DAA099879667AC50537F70717C1D786B3513A2D3F331CECCCC66DCCE72F6E4141BFFEE12EBD5EC7B57DAD55DB87E80DA250A816F21158E77C7F3C2820888B5E15C1E06481DA4B45BB1776D2D73C839015A1A86E1C7EBFF45EBE87CD04A0B6C1E10CEEF6369159F82B8975CCA13F62E41FD228726D948751A67D318B9E8D2A68270BF89A07F7096FDC23D0212684A388FA6E19E4A7F14D2F9927F501329ADEF5628D3CE9DB78487B2CBCD36C36091138EC64B588B01CFA442243C60F33B89F62168E9BA3C41CF4D348D94064F860072F4B8DF08F6FCD3E80EA105244B36EC0473D22E80232D85AEB11F775489A1C303978C95085727D4C889F835F88CBF5251AEDEFFABEB241A15932901B27BE791115716E8072E30BD03340F7726DEC444982F1178588C9503A052909F30277006386A1AB1C8B8EE8E398521B45B92BA7811855FB6A55F6F8E0E99B83BB60A0418B2BAA01FD9903F76903F91614CAE13E46ED3FC71004215952A7E0F1EEC32967E423BE666945A232A08F70F2B737CAB79822845F744BD39B31B0FA71BF632C07071FAC226B0352D59757390D133E3E4B5540D2D4CBC59FEDADA0C59EDD0BF13C497025E48C751038EEF534DEBF56ADAE055D5F3D3BC8B9499332193AB169C9318B5104B9743E54C5DF41241B6924E433BF7E646EA5791A5E8471B3236A2DA1A27B1D9BD95246730561C9A4644D535F9F046BB8534828A47761101E60A3DBBB3C78FB119114D3AF32FE3126754B3A6F22971C6648ED067F0B1BAA53074244573452B0D938B5F60BD0E4C5500F1252E29422DBFB74F8124F26BF9E0A4053096FDBAA29BD01D26E9EB66FB68D40EC0DBF2CD7A45E623BA01359773348F3D448A073A167F02005BCB3D813D7887C12740963256C0463EEC52C2687AF0F149886079EEEB7213EA96C197EEA1420617F373A0155B5EBD271F697389782D3539C168B7F35E191F6B3AD8EDF0D001C8AA087A37D79A5582DA48B6F24F4394F5855C5A2A1275862FC660205A44852F11B47C5390DD136087E361A897161C0AAF898A5EDC233497F4C12E95634B5971BBC4BD255DC6EB133E52657465B1C979D599998D31A5645C712174124F1994542AE9591236219064E6DC81766942B921EBFD2D559CE4D3C24CB00FFAC1296D826EFC89A04E697107D95A6AF5B388F38DC0B3BB19A2461347B76891B7C50500B33D4F74DDD6D2C50DE20EAE321E0D9EFF5A56A1A913AC989AEE045C0658EEC51F37DB5C0245085AB6A05C373A1798659097384551F1932F6081D9614CADC5283F36062AE8CFACCD914854D9C70F1E02D23FEFE5F7F4F82919E88F599E61957FB1EEB035A4769235A216FD73288CF93EF89C4AFA9A90695E1E536A636E4C05A9D99C115AB57F5E70CE1F32AF0FBE0DFE3451C04ECCF505092794E59C40BD46C1A15D7B3A6F327D3CCBE27EF7B51E791D6636233FA512D0E67A9123495A831DB2185C8D868D49E5909E416D5068A0A56AC4F5 -> new value = 4C2CAEECF8A634EA25573D285086DD95E237E9FDC9C14212829C870528A5E40B06A1132164966B1714FFF6D6A44841A8E50A3879583727EAE6F795771D6AD0F27CC3CA1AC94F540D1FFD5EF51E1B3AA4532FF6018B56600A79C0071D679D370A5DEC34E5D6A6BED051D939A59DEF8063108A009FA8FCB4E4EF61528CB141BAE5B7A5B8B6338380C157D663DC082CB9A9F99751D3DEBAF099F03FF45D1971B0D0407336936A47AA0CF4AE7664430AC6657839F1FB35E21BB7A394C07BA6A5E744598B448DBA09BCA94B6B970FF9B245A302A28E01491F34E14376B11F496B54B6AA3FD08AAA8750FA26324D5B4BBB85F9D0D4090086EF9941649B01BB93B346F68710CFBFCFB0696B7A85BB4FC237B291444AC540183B95E741A49832FBF21A38423C3DCFC1B66ED20BA010E2474A639E87E6CBC27486BD10091E3A95F148765A83D9CB5D6161158589D37D690F26E69C39C8AC8A38C88E0BE42BF97AC318E733A9DFAD68D54789B4602A8291369B63F84B9234E5140465422395F8E6CA72BEC11A613A833BCB0311333A6DBF6D6A94641E454B6C50D349CB385BD24E954E749A30046AD04F122E1E9E16CC403C41EF0B4519FAB859CFC793AB300D9723394A77D566D7EFB44F9CAE2274E71D5BC8AEA7F63D7932300B2D79FC34482FD656A779695D106F63B411C94D6761C7893D44993176DC9607B08C117061169FFCBE72350A1C995FBCF34C2075C122F8035B235237ABE64CCC9ECFC9F0F04ACA14138AB5862C688A72A94C6D892C1618E43A8834A8161DEFE74A46A41EE757E9DE46E464E5B4FB647B2AE408699CBE29C72ED2996DEE277AD67733EA7D7FD0119A20A8A32E6582E483D7D038817F75B9E75A57CBD23C738889442DC50431B312150BBF6F697939D46586E5B02A024EF3EBB810F290D7B9771BE65C75FB6914BE615933FDF6040778CD90C42242E53DC59D3EF692B3EAAB66C95ECD0FA62D74F5F630A4AA0FB46E175494F931EFDC34191354746F26A40F18B7BDE0EFE3C85BCCD7151106EE8565100F35C3747193FC42C443F606802C63C4E7E29091D9C46148A14F9893C0B79860DD981C226A092FF15F0548A93BD838A6E69233DB0800635E803E5DB3992182357CBFC78E557708F476064F1B0303C9B4A68E49C23E290D03E5A289DE7257FA7C3CBD486A65173ED7497A07AB229DF32CED3B25FA11AB48D1E8F3E933D8CE57C78CC9BA76D421068DD4D97A5DB9A59460F948B4D1EAFC73E05B463B001E3EDD55707AAB25A06EEB7993377837102463356CF8142FD0EC22F4C9CBBE0AADB3E68E9052B78ED8775B9E549DD75B571E8806D95F4F3463F9C15C1AF0CD72A753F38C7CC95EC9213DF1C5D91484CFF63DFAD7F2F04BB64E58829576341F201C2710D6F806B18257D1AA5FF063D5AD734C69DFA00781C516B99B853066C9D58DCEF69E3E78A02596611E93009128B0541D3882279855B020C1E8FC9970585C12A2C652E0F7C652FEEF85E3B4B02BC3B9C45CB98586391523D61773FC7EE6A374DEC7CC8FFC8005DB95DA8F2202260F7DD891CFC0511BA2A1543272370B48C142182A6C1E71BEB9E39A382F1641F11592FC47477BD7F70422AEFC4D904EAAA4497EA311AA37CE9B2E3997C7288159539CAD6C1B8FECA56FC85B1FD0EB47C269048F865AA2BD46403E2E1A953D88C4545960332A7AE115E254455AE3423EC8DEC1666979AFA02D2D8E188072908F8981ABB9D66A280B29481119501089B1C2485915D6E1A29CB90F5F746F3B0395788BC1BC6433396BF1100F5E0CAFA12264F9E1D6E82E9E8BE770C81D7E3A75C4FC5E0704529298F68D5ABE649B69ECF9F3E60AD4D6883E7201BE0E11A53428CD46EDECB650DB92C53D5D6815681A0C77FCFBA906B3DDBFDA5D8551C0827DA9B27223BAB4D87EE30D513F8AC7D90F770B168AFFB6F2B15C2A98AB6E4DA2396DC5443B57CCD9E6E07133FEB6889082A95078B1C58D6FE1299FA0F6A1DD7032B102518F9461AC2157C83E2113CC00E1F9104597A64D32C9D0FBA498EE7973CE252A54EC086F0CE4299BF61F1E58B614EA41AD704F2CCA39462958F47A8FAF5EE80BD918FE0BE5F95409C1E32CCEFADE97CC74027C320DA247A60269CBA66EAC2D95BCFC19D6C53D19055FD7EE8D43346B44613365BD91367CC822F914F19EAA1F7281D2E8A93C5BBBE8F584E65C683A74F025D46A37C4802D70FEDC48C28643DAF1A4CD1F080216883B8608392562A2B56EFB914C15E1CD212D1E96570690066A7B984BF9D9E001F8D38A398310F9368E7C84E947735F2AF58D4411655A20D7D67CBC152A183D358B491DD31EEEE7E14DC49E3FEB12965B70EEF5243A82D7190A61146916A408131E9A8976BD0C125F7B6332A55F3AC5E5BA8316981B973157785EF2B4D4096D02E7D607D3AE7C9A96AF4512DABA6908363C0BD49DCC82A8361372AA89E70737B2C081DA3CC4E4DDB3AE61426C143F9E96EF55F3FD4E2F74696A7A80E1)
    
11. •    HKEY_CURRENT_USER\\Software\Microsoft\SkyDrive : Giekav (value = AAB4ACC8CCE7F90AF80EA888665948D654BF6E9457A937F4E2402A8E948566FFE51340B8BC45311D1EC9D3B34A83E650FA746EE563BC4F01E2A02EC4BDBC8B11C4F5B6FAD9EB7638E1787296E0264667C887733BDCBDDBE0CB08EDCDFD4BB1410A730B0591130C88E9EB32E01A7A3792DA741928B6453E711D13E5362F9AAA4EB31394BB1D9DD7E63EDD6619355900B068826F88397ACD7AC60E3D5E5226B0DE332F4E2B06D621CEAD7F7018CFCAFD91A506035E7EB8C77DA766DDAE29E12D3AFE8F52FD5669BD132A7017AE1EF8E30FCF17A7D4EAF5AC6F042E25F222878258A7BDF851831408508D0E34C886C18F8FBFE419000DE09FA958E1E94EBB5705D028498D2EC9F0FB74C58E4B20BEEA08D787FAC616C5E63C77951E310ADE38BCF3B4DA295520E60C13292A2F84246101569BA6D2F97415FBE8611D9CAC38CDE5898F28D6C53E003626AA08862C73A8CAB440ECF087FBE6B3187B3ADCCAD03C75D439C400ED71B4EFE1A9C34B5A0C4A14B2F827456D0981519D537F714AA1567CB731D435C6233C728FDC0687C8D38EAA4E2DF683FE4334E4AEF92CF46B74BA7EFF40C1A29200DB233420373C4A01E47BE62F34CDC691475265A1FAC27C7D4BB89E32D484F4FD7D0C117F9DB0B1376ABDCC09CA7991407F1AD1D4F7AC453DB21876464ECAF84D667E1AF1A7517B1EDE8694DC6184D82C57DE05B7F2ED24F5133D40523A1D72740A4ED33169B4DA9F8340F63CBE122A9E9E38C7CBC9B440449E5CBCB8875527E549EBCA5F097B2C505057051C3FB5B1A7E9D3E40D1596AFF5C76C14ECC2E2EEDC3D06057274363BD07F5AE7C437E9D056C7C289CA15D75BB6B1B72D8876C869F224D88800C466D5A8D92A950352D447E53C0F17BC8F14A409A77A82DC76521D6B431DBDF9B28F58B44A909EE3A3F8456B67D727ACCD43049916C2AB8647FE08E7C0925B430B43DF9A79D0F530647743659D150F8E84CFEBE6B752B0F489975E2A2AF6DAA099879667AC50537F70717C1D786B3513A2D3F331CECCCC66DCCE72F6E4141BFFEE12EBD5EC7B57DAD55DB87E80DA250A816F21158E77C7F3C2820888B5E15C1E06481DA4B45BB1776D2D73C839015A1A86E1C7EBFF45EBE87CD04A0B6C1E10CEEF6369159F82B8975CCA13F62E41FD228726D948751A67D318B9E8D2A68270BF89A07F7096FDC23D0212684A388FA6E19E4A7F14D2F9927F501329ADEF5628D3CE9DB78487B2CBCD36C36091138EC64B588B01CFA442243C60F33B89F62168E9BA3C41CF4D348D94064F860072F4B8DF08F6FCD3E80EA105244B36EC0473D22E80232D85AEB11F775489A1C303978C95085727D4C889F835F88CBF5251AEDEFFABEB241A15932901B27BE791115716E8072E30BD03340F7726DEC444982F1178588C9503A052909F30277006386A1AB1C8B8EE8E398521B45B92BA7811855FB6A55F6F8E0E99B83BB60A0418B2BAA01FD9903F76903F91614CAE13E46ED3FC71004215952A7E0F1EEC32967E423BE666945A232A08F70F2B737CAB79822845F744BD39B31B0FA71BF632C07071FAC226B0352D59757390D133E3E4B5540D2D4CBC59FEDADA0C59EDD0BF13C497025E48C751038EEF534DEBF56ADAE055D5F3D3BC8B9499332193AB169C9318B5104B9743E54C5DF41241B6924E433BF7E646EA5791A5E8471B3236A2DA1A27B1D9BD95246730561C9A4644D535F9F046BB8534828A47761101E60A3DBBB3C78FB119114D3AF32FE3126754B3A6F22971C6648ED067F0B1BAA53074244573452B0D938B5F60BD0E4C5500F1252E29422DBFB74F8124F26BF9E0A4053096FDBAA29BD01D26E9EB66FB68D40EC0DBF2CD7A45E623BA01359773348F3D448A073A167F02005BCB3D813D7887C12740963256C0463EEC52C2687AF0F149886079EEEB7213EA96C197EEA1420617F373A0155B5EBD271F697389782D3539C168B7F35E191F6B3AD8EDF0D001C8AA087A37D79A5582DA48B6F24F4394F5855C5A2A1275862FC660205A44852F11B47C5390DD136087E361A897161C0AAF898A5EDC233497F4C12E95634B5971BBC4BD255DC6EB133E52657465B1C979D599998D31A5645C712174124F1994542AE9591236219064E6DC81766942B921EBFD2D559CE4D3C24CB00FFAC1296D826EFC89A04E697107D95A6AF5B388F38DC0B3BB19A2461347B76891B7C50500B33D4F74DDD6D2C50DE20EAE321E0D9EFF5A56A1A913AC989AEE045C0658EEC51F37DB5C0245085AB6A05C373A1798659097384551F1932F6081D9614CADC5283F36062AE8CFACCD914854D9C70F1E02D23FEFE5F7F4F82919E88F599E61957FB1EEB035A4769235A216FD73288CF93EF89C4AFA9A90695E1E536A636E4C05A9D99C115AB57F5E70CE1F32AF0FBE0DFE3451C04ECCF505092794E59C40BD46C1A15D7B3A6F327D3CCBE27EF7B51E791D6636233FA512D0E67A9123495A831DB2185C8D868D49E5909E416D5068A0A56AC4F5)
    
12. •    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Run : NativeCache.exe (value = "C:\Users\jeff6\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LKGV2DXW\home.mcafee.com\AppSupport\Common\Secure\NativeCache.exe")

复制代码

XZ8SM7Sx0bVkoUV

火绒kill

和泉纱雾

KSOS

瓜皮猫

ESET miss

Jerry.Lin

360

和泉纱雾

petr0vic

和泉纱雾