Trojan.PWS.Siggen.26846

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1631955863' = '<LS_APPDATA>\uhx.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

<LS_APPDATA>\uhx.exe -gav <Full path to virus>

Searches for registry branches where third party applications store passwords:

[<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
[<HKLM>\Software\FlashFXP]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
[<HKCU>\Software\BPFTP]
[<HKCU>\Software\South River Technologies\WebDrive\Connections]
[<HKLM>\Software\South River Technologies\WebDrive\Connections]
[<HKCU>\Software\FTPWare\COREFTP\Sites]
[<HKCU>\Software\Sota\FFFTP\Options]
[<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
[<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far2\Plugins\FTP\Hosts]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\FlashFXP]
[<HKLM>\Software\FlashFXP\3]
[<HKCU>\Software\FlashFXP\3]
[<HKLM>\Software\Ghisler\Windows Commander]
[<HKLM>\Software\Ghisler\Total Commander]

Modifies file system :

Creates the following files:

%TEMP%\aek1F7.tmp
%TEMP%\aek1F6.tmp
%TEMP%\aek1F8.tmp
%TEMP%\aek1FA.tmp
%TEMP%\aek1F9.tmp
%TEMP%\aek1F5.tmp
%TEMP%\aek1F1.tmp
%TEMP%\aek1F0.tmp
%TEMP%\aek1F2.tmp
%TEMP%\aek1F4.tmp
%TEMP%\aek1F3.tmp
%TEMP%\aek1FB.tmp
%TEMP%\aek203.tmp
%TEMP%\aek202.tmp
%TEMP%\aek204.tmp
%TEMP%\aek206.tmp
%TEMP%\aek205.tmp
%TEMP%\aek201.tmp
%TEMP%\aek1FD.tmp
%TEMP%\aek1FC.tmp
%TEMP%\aek1FE.tmp
%TEMP%\aek200.tmp
%TEMP%\aek1FF.tmp
%TEMP%\aek1EF.tmp
%TEMP%\aek1DF.tmp
%TEMP%\aek1DE.tmp
%TEMP%\aek1E0.tmp
%TEMP%\aek1E2.tmp
%TEMP%\aek1E1.tmp
%TEMP%\aek1DD.tmp
%TEMP%\aek1D9.tmp
%TEMP%\aek1D8.tmp
%TEMP%\aek1DA.tmp
%TEMP%\aek1DC.tmp
%TEMP%\aek1DB.tmp
%TEMP%\aek1E3.tmp
%TEMP%\aek1EB.tmp
%TEMP%\aek1EA.tmp
%TEMP%\aek1EC.tmp
%TEMP%\aek1EE.tmp
%TEMP%\aek1ED.tmp
%TEMP%\aek1E9.tmp
%TEMP%\aek1E5.tmp
%TEMP%\aek1E4.tmp
%TEMP%\aek1E6.tmp
%TEMP%\aek1E8.tmp
%TEMP%\aek1E7.tmp
%TEMP%\aek226.tmp
%TEMP%\aek225.tmp
%TEMP%\aek227.tmp
%TEMP%\aek229.tmp
%TEMP%\aek228.tmp
%TEMP%\aek224.tmp
%TEMP%\aek220.tmp
%TEMP%\aek21F.tmp
%TEMP%\aek221.tmp
%TEMP%\aek223.tmp
%TEMP%\aek222.tmp
%TEMP%\aek22A.tmp
%TEMP%\aek232.tmp
%TEMP%\aek231.tmp
%TEMP%\aek233.tmp
%TEMP%\aek235.tmp
%TEMP%\aek234.tmp
%TEMP%\aek230.tmp
%TEMP%\aek22C.tmp
%TEMP%\aek22B.tmp
%TEMP%\aek22D.tmp
%TEMP%\aek22F.tmp
%TEMP%\aek22E.tmp
%TEMP%\aek21E.tmp
%TEMP%\aek20E.tmp
%TEMP%\aek20D.tmp
%TEMP%\aek20F.tmp
%TEMP%\aek211.tmp
%TEMP%\aek210.tmp
%TEMP%\aek20C.tmp
%TEMP%\aek208.tmp
%TEMP%\aek207.tmp
%TEMP%\aek209.tmp
%TEMP%\aek20B.tmp
%TEMP%\aek20A.tmp
%TEMP%\aek212.tmp
%TEMP%\aek21A.tmp
%TEMP%\aek219.tmp
%TEMP%\aek21B.tmp
%TEMP%\aek21D.tmp
%TEMP%\aek21C.tmp
%TEMP%\aek218.tmp
%TEMP%\aek214.tmp
%TEMP%\aek213.tmp
%TEMP%\aek215.tmp
%TEMP%\aek217.tmp
%TEMP%\aek216.tmp
%TEMP%\aek199.tmp
%TEMP%\aek198.tmp
%TEMP%\aek19A.tmp
%TEMP%\aek19C.tmp
%TEMP%\aek19B.tmp
%TEMP%\aek197.tmp
%TEMP%\aek193.tmp
%TEMP%\aek192.tmp
%TEMP%\aek194.tmp
%TEMP%\aek196.tmp
%TEMP%\aek195.tmp
%TEMP%\aek19D.tmp
%TEMP%\aek1A5.tmp
%TEMP%\aek1A4.tmp
%TEMP%\aek1A6.tmp
%TEMP%\aek1A8.tmp
%TEMP%\aek1A7.tmp
%TEMP%\aek1A3.tmp
%TEMP%\aek19F.tmp
%TEMP%\aek19E.tmp
%TEMP%\aek1A0.tmp
%TEMP%\aek1A2.tmp
%TEMP%\aek1A1.tmp
%TEMP%\aek191.tmp
%TEMP%\aek181.tmp
%TEMP%\aek180.tmp
%TEMP%\aek182.tmp
%TEMP%\aek184.tmp
%TEMP%\aek183.tmp
%TEMP%\aek17F.tmp
%TEMP%\aek17B.tmp
%TEMP%\aek17A.tmp
%TEMP%\aek17C.tmp
%TEMP%\aek17E.tmp
%TEMP%\aek17D.tmp
%TEMP%\aek185.tmp
%TEMP%\aek18D.tmp
%TEMP%\aek18C.tmp
%TEMP%\aek18E.tmp
%TEMP%\aek190.tmp
%TEMP%\aek18F.tmp
%TEMP%\aek18B.tmp
%TEMP%\aek187.tmp
%TEMP%\aek186.tmp
%TEMP%\aek188.tmp
%TEMP%\aek18A.tmp
%TEMP%\aek189.tmp
%TEMP%\aek1C8.tmp
%TEMP%\aek1C7.tmp
%TEMP%\aek1C9.tmp
%TEMP%\aek1CB.tmp
%TEMP%\aek1CA.tmp
%TEMP%\aek1C6.tmp
%TEMP%\aek1C2.tmp
%TEMP%\aek1C1.tmp
%TEMP%\aek1C3.tmp
%TEMP%\aek1C5.tmp
%TEMP%\aek1C4.tmp
%TEMP%\aek1CC.tmp
%TEMP%\aek1D4.tmp
%TEMP%\aek1D3.tmp
%TEMP%\aek1D5.tmp
%TEMP%\aek1D7.tmp
%TEMP%\aek1D6.tmp
%TEMP%\aek1D2.tmp
%TEMP%\aek1CE.tmp
%TEMP%\aek1CD.tmp
%TEMP%\aek1CF.tmp
%TEMP%\aek1D1.tmp
%TEMP%\aek1D0.tmp
%TEMP%\aek1C0.tmp
%TEMP%\aek1B0.tmp
%TEMP%\aek1AF.tmp
%TEMP%\aek1B1.tmp
%TEMP%\aek1B3.tmp
%TEMP%\aek1B2.tmp
%TEMP%\aek1AE.tmp
%TEMP%\aek1AA.tmp
%TEMP%\aek1A9.tmp
%TEMP%\aek1AB.tmp
%TEMP%\aek1AD.tmp
%TEMP%\aek1AC.tmp
%TEMP%\aek1B4.tmp
%TEMP%\aek1BC.tmp
%TEMP%\aek1BB.tmp
%TEMP%\aek1BD.tmp
%TEMP%\aek1BF.tmp
%TEMP%\aek1BE.tmp
%TEMP%\aek1BA.tmp
%TEMP%\aek1B6.tmp
%TEMP%\aek1B5.tmp
%TEMP%\aek1B7.tmp
%TEMP%\aek1B9.tmp
%TEMP%\aek1B8.tmp
%TEMP%\aek236.tmp
%TEMP%\aek2A3.tmp
%TEMP%\aek2A2.tmp
%TEMP%\aek2A4.tmp
%TEMP%\aek2A6.tmp
%TEMP%\aek2A5.tmp
%TEMP%\aek2A1.tmp
%TEMP%\aek29D.tmp
%TEMP%\aek29C.tmp
%TEMP%\aek29E.tmp
%TEMP%\aek2A0.tmp
%TEMP%\aek29F.tmp
%TEMP%\aek2A7.tmp
%TEMP%\aek2AF.tmp
%TEMP%\aek2AE.tmp
%TEMP%\aek2B0.tmp
%TEMP%\aek2B2.tmp
%TEMP%\aek2B1.tmp
%TEMP%\aek2AD.tmp
%TEMP%\aek2A9.tmp
%TEMP%\aek2A8.tmp
%TEMP%\aek2AA.tmp
%TEMP%\aek2AC.tmp
%TEMP%\aek2AB.tmp
%TEMP%\aek29B.tmp
%TEMP%\aek28B.tmp
%TEMP%\aek28A.tmp
%TEMP%\aek28C.tmp
%TEMP%\aek28E.tmp
%TEMP%\aek28D.tmp
%TEMP%\aek289.tmp
%TEMP%\aek285.tmp
%TEMP%\aek284.tmp
%TEMP%\aek286.tmp
%TEMP%\aek288.tmp
%TEMP%\aek287.tmp
%TEMP%\aek28F.tmp
%TEMP%\aek297.tmp
%TEMP%\aek296.tmp
%TEMP%\aek298.tmp
%TEMP%\aek29A.tmp
%TEMP%\aek299.tmp
%TEMP%\aek295.tmp
%TEMP%\aek291.tmp
%TEMP%\aek290.tmp
%TEMP%\aek292.tmp
%TEMP%\aek294.tmp
%TEMP%\aek293.tmp
%TEMP%\aek2D2.tmp
%TEMP%\aek2D1.tmp
%TEMP%\aek2D3.tmp
%TEMP%\aek2D5.tmp
%TEMP%\aek2D4.tmp
%TEMP%\aek2D0.tmp
%TEMP%\aek2CC.tmp
%TEMP%\aek2CB.tmp
%TEMP%\aek2CD.tmp
%TEMP%\aek2CF.tmp
%TEMP%\aek2CE.tmp
%TEMP%\aek2D6.tmp
%TEMP%\aek2DE.tmp
%TEMP%\aek2DD.tmp
%TEMP%\aek2DF.tmp
%TEMP%\aek2E1.tmp
%TEMP%\aek2E0.tmp
%TEMP%\aek2DC.tmp
%TEMP%\aek2D8.tmp
%TEMP%\aek2D7.tmp
%TEMP%\aek2D9.tmp
%TEMP%\aek2DB.tmp
%TEMP%\aek2DA.tmp
%TEMP%\aek2CA.tmp
%TEMP%\aek2BA.tmp
%TEMP%\aek2B9.tmp
%TEMP%\aek2BB.tmp
%TEMP%\aek2BD.tmp
%TEMP%\aek2BC.tmp
%TEMP%\aek2B8.tmp
%TEMP%\aek2B4.tmp
%TEMP%\aek2B3.tmp
%TEMP%\aek2B5.tmp
%TEMP%\aek2B7.tmp
%TEMP%\aek2B6.tmp
%TEMP%\aek2BE.tmp
%TEMP%\aek2C6.tmp
%TEMP%\aek2C5.tmp
%TEMP%\aek2C7.tmp
%TEMP%\aek2C9.tmp
%TEMP%\aek2C8.tmp
%TEMP%\aek2C4.tmp
%TEMP%\aek2C0.tmp
%TEMP%\aek2BF.tmp
%TEMP%\aek2C1.tmp
%TEMP%\aek2C3.tmp
%TEMP%\aek2C2.tmp
%TEMP%\aek245.tmp
%TEMP%\aek244.tmp
%TEMP%\aek246.tmp
%TEMP%\aek248.tmp
%TEMP%\aek247.tmp
%TEMP%\aek243.tmp
%TEMP%\aek241.tmp
%ALLUSERSPROFILE%\Application Data\lypq.exe
%TEMP%\juvt.exe
%HOMEPATH%\Templates\qxkk.exe
%TEMP%\aek242.tmp
%TEMP%\aek249.tmp
%TEMP%\aek251.tmp
%TEMP%\aek250.tmp
%TEMP%\aek252.tmp
%TEMP%\aek254.tmp
%TEMP%\aek253.tmp
%TEMP%\aek24F.tmp
%TEMP%\aek24B.tmp
%TEMP%\aek24A.tmp
%TEMP%\aek24C.tmp
%TEMP%\aek24E.tmp
%TEMP%\aek24D.tmp
%TEMP%\aek240.tmp
%ALLUSERSPROFILE%\Application Data\yntf.exe
<LS_APPDATA>\feoo.exe
%TEMP%\fcqs.exe
<LS_APPDATA>\apcs.exe
%HOMEPATH%\Templates\glcd.exe
<LS_APPDATA>\uhx.exe
%TEMP%\aek238.tmp
%TEMP%\aek237.tmp
%TEMP%\aek239.tmp
%TEMP%\aek23B.tmp
%TEMP%\aek23A.tmp
%ALLUSERSPROFILE%\Application Data\qduq.exe
%TEMP%\tupo.exe
%TEMP%\aek23E.tmp
%TEMP%\aek23F.tmp
<LS_APPDATA>\rqav.exe
%HOMEPATH%\Templates\cqxp.exe
%TEMP%\aek23D.tmp
%TEMP%\tlkc.exe
%TEMP%\aek23C.tmp
%HOMEPATH%\Templates\rbye.exe
%ALLUSERSPROFILE%\Application Data\nnur.exe
<LS_APPDATA>\udum.exe
%TEMP%\aek274.tmp
%TEMP%\aek273.tmp
%TEMP%\aek275.tmp
%TEMP%\aek277.tmp
%TEMP%\aek276.tmp
%TEMP%\aek272.tmp
%TEMP%\aek26E.tmp
%TEMP%\aek26D.tmp
%TEMP%\aek26F.tmp
%TEMP%\aek271.tmp
%TEMP%\aek270.tmp
%TEMP%\aek278.tmp
%TEMP%\aek280.tmp
%TEMP%\aek27F.tmp
%TEMP%\aek281.tmp
%TEMP%\aek283.tmp
%TEMP%\aek282.tmp
%TEMP%\aek27E.tmp
%TEMP%\aek27A.tmp
%TEMP%\aek279.tmp
%TEMP%\aek27B.tmp
%TEMP%\aek27D.tmp
%TEMP%\aek27C.tmp
%TEMP%\aek26C.tmp
%TEMP%\aek25C.tmp
%TEMP%\aek25B.tmp
%TEMP%\aek25D.tmp
%TEMP%\aek25F.tmp
%TEMP%\aek25E.tmp
%TEMP%\aek25A.tmp
%TEMP%\aek256.tmp
%TEMP%\aek255.tmp
%TEMP%\aek257.tmp
%TEMP%\aek259.tmp
%TEMP%\aek258.tmp
%TEMP%\aek260.tmp
%TEMP%\aek268.tmp
%TEMP%\aek267.tmp
%TEMP%\aek269.tmp
%TEMP%\aek26B.tmp
%TEMP%\aek26A.tmp
%TEMP%\aek266.tmp
%TEMP%\aek262.tmp
%TEMP%\aek261.tmp
%TEMP%\aek263.tmp
%TEMP%\aek265.tmp
%TEMP%\aek264.tmp
%TEMP%\aek7E.tmp
%TEMP%\aek7D.tmp
%TEMP%\aek7F.tmp
%TEMP%\aek81.tmp
%TEMP%\aek80.tmp
%TEMP%\aek7C.tmp
%TEMP%\aek78.tmp
%TEMP%\aek77.tmp
%TEMP%\aek79.tmp
%TEMP%\aek7B.tmp
%TEMP%\aek7A.tmp
%TEMP%\aek82.tmp
%TEMP%\aek8A.tmp
%TEMP%\aek89.tmp
%TEMP%\aek8B.tmp
%TEMP%\aek8D.tmp
%TEMP%\aek8C.tmp
%TEMP%\aek88.tmp
%TEMP%\aek84.tmp
%TEMP%\aek83.tmp
%TEMP%\aek85.tmp
%TEMP%\aek87.tmp
%TEMP%\aek86.tmp
%TEMP%\aek76.tmp
%TEMP%\aek66.tmp
%TEMP%\aek65.tmp
%TEMP%\aek67.tmp
%TEMP%\aek69.tmp
%TEMP%\aek68.tmp
%TEMP%\aek64.tmp
%TEMP%\aek60.tmp
%TEMP%\aek5F.tmp
%TEMP%\aek61.tmp
%TEMP%\aek63.tmp
%TEMP%\aek62.tmp
%TEMP%\aek6A.tmp
%TEMP%\aek72.tmp
%TEMP%\aek71.tmp
%TEMP%\aek73.tmp
%TEMP%\aek75.tmp
%TEMP%\aek74.tmp
%TEMP%\aek70.tmp
%TEMP%\aek6C.tmp
%TEMP%\aek6B.tmp
%TEMP%\aek6D.tmp
%TEMP%\aek6F.tmp
%TEMP%\aek6E.tmp
%TEMP%\aekAD.tmp
%TEMP%\aekAC.tmp
%TEMP%\aekAE.tmp
%TEMP%\aekB0.tmp
%TEMP%\aekAF.tmp
%TEMP%\aekAB.tmp
%TEMP%\aekA7.tmp
%TEMP%\aekA6.tmp
%TEMP%\aekA8.tmp
%TEMP%\aekAA.tmp
%TEMP%\aekA9.tmp
%TEMP%\aekB1.tmp
%TEMP%\aekB9.tmp
%TEMP%\aekB8.tmp
%TEMP%\aekBA.tmp
%TEMP%\aekBC.tmp
%TEMP%\aekBB.tmp
%TEMP%\aekB7.tmp
%TEMP%\aekB3.tmp
%TEMP%\aekB2.tmp
%TEMP%\aekB4.tmp
%TEMP%\aekB6.tmp
%TEMP%\aekB5.tmp
%TEMP%\aekA5.tmp
%TEMP%\aek95.tmp
%TEMP%\aek94.tmp
%TEMP%\aek96.tmp
%TEMP%\aek98.tmp
%TEMP%\aek97.tmp
%TEMP%\aek93.tmp
%TEMP%\aek8F.tmp
%TEMP%\aek8E.tmp
%TEMP%\aek90.tmp
%TEMP%\aek92.tmp
%TEMP%\aek91.tmp
%TEMP%\aek99.tmp
%TEMP%\aekA1.tmp
%TEMP%\aekA0.tmp
%TEMP%\aekA2.tmp
%TEMP%\aekA4.tmp
%TEMP%\aekA3.tmp
%TEMP%\aek9F.tmp
%TEMP%\aek9B.tmp
%TEMP%\aek9A.tmp
%TEMP%\aek9C.tmp
%TEMP%\aek9E.tmp
%TEMP%\aek9D.tmp
%TEMP%\aek20.tmp
%TEMP%\aek1F.tmp
%TEMP%\aek21.tmp
%TEMP%\aek23.tmp
%TEMP%\aek22.tmp
%TEMP%\aek1E.tmp
%TEMP%\aek1A.tmp
%TEMP%\aek19.tmp
%TEMP%\aek1B.tmp
%TEMP%\aek1D.tmp
%TEMP%\aek1C.tmp
%TEMP%\aek24.tmp
%TEMP%\aek2C.tmp
%TEMP%\aek2B.tmp
%TEMP%\aek2D.tmp
%TEMP%\aek2F.tmp
%TEMP%\aek2E.tmp
%TEMP%\aek2A.tmp
%TEMP%\aek26.tmp
%TEMP%\aek25.tmp
%TEMP%\aek27.tmp
%TEMP%\aek29.tmp
%TEMP%\aek28.tmp
%TEMP%\aek18.tmp
%TEMP%\aek8.tmp
%TEMP%\aek7.tmp
%TEMP%\aek9.tmp
%TEMP%\aekB.tmp
%TEMP%\aekA.tmp
%TEMP%\aek6.tmp
%TEMP%\aek2.tmp
%TEMP%\aek1.tmp
%TEMP%\aek3.tmp
%TEMP%\aek5.tmp
%TEMP%\aek4.tmp
%TEMP%\aekC.tmp
%TEMP%\aek14.tmp
%TEMP%\aek13.tmp
%TEMP%\aek15.tmp
%TEMP%\aek17.tmp
%TEMP%\aek16.tmp
%TEMP%\aek12.tmp
%TEMP%\aekE.tmp
%TEMP%\aekD.tmp
%TEMP%\aekF.tmp
%TEMP%\aek11.tmp
%TEMP%\aek10.tmp
%TEMP%\aek4F.tmp
%TEMP%\aek4E.tmp
%TEMP%\aek50.tmp
%TEMP%\aek52.tmp
%TEMP%\aek51.tmp
%TEMP%\aek4D.tmp
%TEMP%\aek49.tmp
%TEMP%\aek48.tmp
%TEMP%\aek4A.tmp
%TEMP%\aek4C.tmp
%TEMP%\aek4B.tmp
%TEMP%\aek53.tmp
%TEMP%\aek5B.tmp
%TEMP%\aek5A.tmp
%TEMP%\aek5C.tmp
%TEMP%\aek5E.tmp
%TEMP%\aek5D.tmp
%TEMP%\aek59.tmp
%TEMP%\aek55.tmp
%TEMP%\aek54.tmp
%TEMP%\aek56.tmp
%TEMP%\aek58.tmp
%TEMP%\aek57.tmp
%TEMP%\aek47.tmp
%TEMP%\aek37.tmp
%TEMP%\aek36.tmp
%TEMP%\aek38.tmp
%TEMP%\aek3A.tmp
%TEMP%\aek39.tmp
%TEMP%\aek35.tmp
%TEMP%\aek31.tmp
%TEMP%\aek30.tmp
%TEMP%\aek32.tmp
%TEMP%\aek34.tmp
%TEMP%\aek33.tmp
%TEMP%\aek3B.tmp
%TEMP%\aek43.tmp
%TEMP%\aek42.tmp
%TEMP%\aek44.tmp
%TEMP%\aek46.tmp
%TEMP%\aek45.tmp
%TEMP%\aek41.tmp
%TEMP%\aek3D.tmp
%TEMP%\aek3C.tmp
%TEMP%\aek3E.tmp
%TEMP%\aek40.tmp
%TEMP%\aek3F.tmp
%TEMP%\aekBD.tmp
%TEMP%\aek13B.tmp
%TEMP%\aek13A.tmp
%TEMP%\aek13C.tmp
%TEMP%\aek13E.tmp
%TEMP%\aek13D.tmp
%TEMP%\aek139.tmp
%TEMP%\aek135.tmp
%TEMP%\aek134.tmp
%TEMP%\aek136.tmp
%TEMP%\aek138.tmp
%TEMP%\aek137.tmp
%TEMP%\aek13F.tmp
%TEMP%\aek147.tmp
%TEMP%\aek146.tmp
%TEMP%\aek148.tmp
%TEMP%\aek14A.tmp
%TEMP%\aek149.tmp
%TEMP%\aek145.tmp
%TEMP%\aek141.tmp
%TEMP%\aek140.tmp
%TEMP%\aek142.tmp
%TEMP%\aek144.tmp
%TEMP%\aek143.tmp
%TEMP%\aek133.tmp
%TEMP%\aek123.tmp
%TEMP%\aek122.tmp
%TEMP%\aek124.tmp
%TEMP%\aek126.tmp
%TEMP%\aek125.tmp
%TEMP%\aek121.tmp
%TEMP%\aek11D.tmp
%TEMP%\aek11C.tmp
%TEMP%\aek11E.tmp
%TEMP%\aek120.tmp
%TEMP%\aek11F.tmp
%TEMP%\aek127.tmp
%TEMP%\aek12F.tmp
%TEMP%\aek12E.tmp
%TEMP%\aek130.tmp
%TEMP%\aek132.tmp
%TEMP%\aek131.tmp
%TEMP%\aek12D.tmp
%TEMP%\aek129.tmp
%TEMP%\aek128.tmp
%TEMP%\aek12A.tmp
%TEMP%\aek12C.tmp
%TEMP%\aek12B.tmp
%TEMP%\aek16A.tmp
%TEMP%\aek169.tmp
%TEMP%\aek16B.tmp
%TEMP%\aek16D.tmp
%TEMP%\aek16C.tmp
%TEMP%\aek168.tmp
%TEMP%\aek164.tmp
%TEMP%\aek163.tmp
%TEMP%\aek165.tmp
%TEMP%\aek167.tmp
%TEMP%\aek166.tmp
%TEMP%\aek16E.tmp
%TEMP%\aek176.tmp
%TEMP%\aek175.tmp
%TEMP%\aek177.tmp
%TEMP%\aek179.tmp
%TEMP%\aek178.tmp
%TEMP%\aek174.tmp
%TEMP%\aek170.tmp
%TEMP%\aek16F.tmp
%TEMP%\aek171.tmp
%TEMP%\aek173.tmp
%TEMP%\aek172.tmp
%TEMP%\aek162.tmp
%TEMP%\aek152.tmp
%TEMP%\aek151.tmp
%TEMP%\aek153.tmp
%TEMP%\aek155.tmp
%TEMP%\aek154.tmp
%TEMP%\aek150.tmp
%TEMP%\aek14C.tmp
%TEMP%\aek14B.tmp
%TEMP%\aek14D.tmp
%TEMP%\aek14F.tmp
%TEMP%\aek14E.tmp
%TEMP%\aek156.tmp
%TEMP%\aek15E.tmp
%TEMP%\aek15D.tmp
%TEMP%\aek15F.tmp
%TEMP%\aek161.tmp
%TEMP%\aek160.tmp
%TEMP%\aek15C.tmp
%TEMP%\aek158.tmp
%TEMP%\aek157.tmp
%TEMP%\aek159.tmp
%TEMP%\aek15B.tmp
%TEMP%\aek15A.tmp
%TEMP%\aekDD.tmp
%TEMP%\aekDC.tmp
%TEMP%\aekDE.tmp
%TEMP%\aekE0.tmp
%TEMP%\aekDF.tmp
%TEMP%\aekDB.tmp
%TEMP%\aekD7.tmp
%TEMP%\aekD6.tmp
%TEMP%\aekD8.tmp
%TEMP%\aekDA.tmp
%TEMP%\aekD9.tmp
%TEMP%\aekE1.tmp
%TEMP%\aekE9.tmp
%TEMP%\aekE8.tmp
%TEMP%\aekEA.tmp
%TEMP%\aekEC.tmp
%TEMP%\aekEB.tmp
%TEMP%\aekE7.tmp
%TEMP%\aekE3.tmp
%TEMP%\aekE2.tmp
%TEMP%\aekE4.tmp
%TEMP%\aekE6.tmp
%TEMP%\aekE5.tmp
%TEMP%\aekD5.tmp
%TEMP%\aekC5.tmp
%TEMP%\aekC4.tmp
%TEMP%\aekC6.tmp
%TEMP%\aekC8.tmp
%TEMP%\aekC7.tmp
%TEMP%\aekC3.tmp
%TEMP%\aekBF.tmp
%TEMP%\aekBE.tmp
%TEMP%\aekC0.tmp
%TEMP%\aekC2.tmp
%TEMP%\aekC1.tmp
%TEMP%\aekC9.tmp
%TEMP%\aekD1.tmp
%TEMP%\aekD0.tmp
%TEMP%\aekD2.tmp
%TEMP%\aekD4.tmp
%TEMP%\aekD3.tmp
%TEMP%\aekCF.tmp
%TEMP%\aekCB.tmp
%TEMP%\aekCA.tmp
%TEMP%\aekCC.tmp
%TEMP%\aekCE.tmp
%TEMP%\aekCD.tmp
%TEMP%\aek10C.tmp
%TEMP%\aek10B.tmp
%TEMP%\aek10D.tmp
%TEMP%\aek10F.tmp
%TEMP%\aek10E.tmp
%TEMP%\aek10A.tmp
%TEMP%\aek106.tmp
%TEMP%\aek105.tmp
%TEMP%\aek107.tmp
%TEMP%\aek109.tmp
%TEMP%\aek108.tmp
%TEMP%\aek110.tmp
%TEMP%\aek118.tmp
%TEMP%\aek117.tmp
%TEMP%\aek119.tmp
%TEMP%\aek11B.tmp
%TEMP%\aek11A.tmp
%TEMP%\aek116.tmp
%TEMP%\aek112.tmp
%TEMP%\aek111.tmp
%TEMP%\aek113.tmp
%TEMP%\aek115.tmp
%TEMP%\aek114.tmp
%TEMP%\aek104.tmp
%TEMP%\aekF4.tmp
%TEMP%\aekF3.tmp
%TEMP%\aekF5.tmp
%TEMP%\aekF7.tmp
%TEMP%\aekF6.tmp
%TEMP%\aekF2.tmp
%TEMP%\aekEE.tmp
%TEMP%\aekED.tmp
%TEMP%\aekEF.tmp
%TEMP%\aekF1.tmp
%TEMP%\aekF0.tmp
%TEMP%\aekF8.tmp
%TEMP%\aek100.tmp
%TEMP%\aekFF.tmp
%TEMP%\aek101.tmp
%TEMP%\aek103.tmp
%TEMP%\aek102.tmp
%TEMP%\aekFE.tmp
%TEMP%\aekFA.tmp
%TEMP%\aekF9.tmp
%TEMP%\aekFB.tmp
%TEMP%\aekFD.tmp
%TEMP%\aekFC.tmp

Deletes the following files:

%TEMP%\aek1EB.tmp
%TEMP%\aek1EA.tmp
%TEMP%\aek1EC.tmp
%TEMP%\aek1EE.tmp
%TEMP%\aek1ED.tmp
%TEMP%\aek1E9.tmp
%TEMP%\aek1E5.tmp
%TEMP%\aek1E4.tmp
%TEMP%\aek1E6.tmp
%TEMP%\aek1E8.tmp
%TEMP%\aek1E7.tmp
%TEMP%\aek1EF.tmp
%TEMP%\aek1F7.tmp
%TEMP%\aek1F6.tmp
%TEMP%\aek1F8.tmp
%TEMP%\aek1FA.tmp
%TEMP%\aek1F9.tmp
%TEMP%\aek1F5.tmp
%TEMP%\aek1F1.tmp
%TEMP%\aek1F0.tmp
%TEMP%\aek1F2.tmp
%TEMP%\aek1F4.tmp
%TEMP%\aek1F3.tmp
%TEMP%\aek1D4.tmp
%TEMP%\aek1D3.tmp
%TEMP%\aek1D5.tmp
%TEMP%\aek1D7.tmp
%TEMP%\aek1D6.tmp
%TEMP%\aek1D2.tmp
%TEMP%\aek1CE.tmp
%TEMP%\aek1CD.tmp
%TEMP%\aek1CF.tmp
%TEMP%\aek1D1.tmp
%TEMP%\aek1D0.tmp
%TEMP%\aek1D8.tmp
%TEMP%\aek1E0.tmp
%TEMP%\aek1DF.tmp
%TEMP%\aek1E1.tmp
%TEMP%\aek1E3.tmp
%TEMP%\aek1E2.tmp
%TEMP%\aek1DE.tmp
%TEMP%\aek1DA.tmp
%TEMP%\aek1D9.tmp
%TEMP%\aek1DB.tmp
%TEMP%\aek1DD.tmp
%TEMP%\aek1DC.tmp
%TEMP%\aek219.tmp
%TEMP%\aek218.tmp
%TEMP%\aek21A.tmp
%TEMP%\aek21C.tmp
%TEMP%\aek21B.tmp
%TEMP%\aek217.tmp
%TEMP%\aek213.tmp
%TEMP%\aek212.tmp
%TEMP%\aek214.tmp
%TEMP%\aek216.tmp
%TEMP%\aek215.tmp
%TEMP%\aek21D.tmp
%TEMP%\aek225.tmp
%TEMP%\aek224.tmp
%TEMP%\aek226.tmp
%TEMP%\aek228.tmp
%TEMP%\aek227.tmp
%TEMP%\aek223.tmp
%TEMP%\aek21F.tmp
%TEMP%\aek21E.tmp
%TEMP%\aek220.tmp
%TEMP%\aek222.tmp
%TEMP%\aek221.tmp
%TEMP%\aek202.tmp
%TEMP%\aek201.tmp
%TEMP%\aek203.tmp
%TEMP%\aek205.tmp
%TEMP%\aek204.tmp
%TEMP%\aek200.tmp
%TEMP%\aek1FC.tmp
%TEMP%\aek1FB.tmp
%TEMP%\aek1FD.tmp
%TEMP%\aek1FF.tmp
%TEMP%\aek1FE.tmp
%TEMP%\aek206.tmp
%TEMP%\aek20E.tmp
%TEMP%\aek20D.tmp
%TEMP%\aek20F.tmp
%TEMP%\aek211.tmp
%TEMP%\aek210.tmp
%TEMP%\aek20C.tmp
%TEMP%\aek208.tmp
%TEMP%\aek207.tmp
%TEMP%\aek209.tmp
%TEMP%\aek20B.tmp
%TEMP%\aek20A.tmp
%TEMP%\aek18F.tmp
%TEMP%\aek18E.tmp
%TEMP%\aek190.tmp
%TEMP%\aek192.tmp
%TEMP%\aek191.tmp
%TEMP%\aek18D.tmp
%TEMP%\aek189.tmp
%TEMP%\aek188.tmp
%TEMP%\aek18A.tmp
%TEMP%\aek18C.tmp
%TEMP%\aek18B.tmp
%TEMP%\aek193.tmp
%TEMP%\aek19B.tmp
%TEMP%\aek19A.tmp
%TEMP%\aek19C.tmp
%TEMP%\aek19E.tmp
%TEMP%\aek19D.tmp
%TEMP%\aek199.tmp
%TEMP%\aek195.tmp
%TEMP%\aek194.tmp
%TEMP%\aek196.tmp
%TEMP%\aek198.tmp
%TEMP%\aek197.tmp
%TEMP%\aek178.tmp
%TEMP%\aek177.tmp
%TEMP%\aek179.tmp
%TEMP%\aek17B.tmp
%TEMP%\aek17A.tmp
%TEMP%\aek176.tmp
%TEMP%\aek172.tmp
%TEMP%\aek171.tmp
%TEMP%\aek173.tmp
%TEMP%\aek175.tmp
%TEMP%\aek174.tmp
%TEMP%\aek17C.tmp
%TEMP%\aek184.tmp
%TEMP%\aek183.tmp
%TEMP%\aek185.tmp
%TEMP%\aek187.tmp
%TEMP%\aek186.tmp
%TEMP%\aek182.tmp
%TEMP%\aek17E.tmp
%TEMP%\aek17D.tmp
%TEMP%\aek17F.tmp
%TEMP%\aek181.tmp
%TEMP%\aek180.tmp
%TEMP%\aek1BD.tmp
%TEMP%\aek1BC.tmp
%TEMP%\aek1BE.tmp
%TEMP%\aek1C0.tmp
%TEMP%\aek1BF.tmp
%TEMP%\aek1BB.tmp
%TEMP%\aek1B7.tmp
%TEMP%\aek1B6.tmp
%TEMP%\aek1B8.tmp
%TEMP%\aek1BA.tmp
%TEMP%\aek1B9.tmp
%TEMP%\aek1C1.tmp
%TEMP%\aek1C9.tmp
%TEMP%\aek1C8.tmp
%TEMP%\aek1CA.tmp
%TEMP%\aek1CC.tmp
%TEMP%\aek1CB.tmp
%TEMP%\aek1C7.tmp
%TEMP%\aek1C3.tmp
%TEMP%\aek1C2.tmp
%TEMP%\aek1C4.tmp
%TEMP%\aek1C6.tmp
%TEMP%\aek1C5.tmp
%TEMP%\aek1A6.tmp
%TEMP%\aek1A5.tmp
%TEMP%\aek1A7.tmp
%TEMP%\aek1A9.tmp
%TEMP%\aek1A8.tmp
%TEMP%\aek1A4.tmp
%TEMP%\aek1A0.tmp
%TEMP%\aek19F.tmp
%TEMP%\aek1A1.tmp
%TEMP%\aek1A3.tmp
%TEMP%\aek1A2.tmp
%TEMP%\aek1AA.tmp
%TEMP%\aek1B2.tmp
%TEMP%\aek1B1.tmp
%TEMP%\aek1B3.tmp
%TEMP%\aek1B5.tmp
%TEMP%\aek1B4.tmp
%TEMP%\aek1B0.tmp
%TEMP%\aek1AC.tmp
%TEMP%\aek1AB.tmp
%TEMP%\aek1AD.tmp
%TEMP%\aek1AF.tmp
%TEMP%\aek1AE.tmp
%TEMP%\aek2A3.tmp
%TEMP%\aek2A2.tmp
%TEMP%\aek2A4.tmp
%TEMP%\aek2A6.tmp
%TEMP%\aek2A5.tmp
%TEMP%\aek2A1.tmp
%TEMP%\aek29D.tmp
%TEMP%\aek29C.tmp
%TEMP%\aek29E.tmp
%TEMP%\aek2A0.tmp
%TEMP%\aek29F.tmp
%TEMP%\aek2A7.tmp
%TEMP%\aek2AF.tmp
%TEMP%\aek2AE.tmp
%TEMP%\aek2B0.tmp
%TEMP%\aek2B2.tmp
%TEMP%\aek2B1.tmp
%TEMP%\aek2AD.tmp
%TEMP%\aek2A9.tmp
%TEMP%\aek2A8.tmp
%TEMP%\aek2AA.tmp
%TEMP%\aek2AC.tmp
%TEMP%\aek2AB.tmp
%TEMP%\aek28C.tmp
%TEMP%\aek28B.tmp
%TEMP%\aek28D.tmp
%TEMP%\aek28F.tmp
%TEMP%\aek28E.tmp
%TEMP%\aek28A.tmp
%TEMP%\aek286.tmp
%TEMP%\aek285.tmp
%TEMP%\aek287.tmp
%TEMP%\aek289.tmp
%TEMP%\aek288.tmp
%TEMP%\aek290.tmp
%TEMP%\aek298.tmp
%TEMP%\aek297.tmp
%TEMP%\aek299.tmp
%TEMP%\aek29B.tmp
%TEMP%\aek29A.tmp
%TEMP%\aek296.tmp
%TEMP%\aek292.tmp
%TEMP%\aek291.tmp
%TEMP%\aek293.tmp
%TEMP%\aek295.tmp
%TEMP%\aek294.tmp
%TEMP%\aek2D1.tmp
%TEMP%\aek2D0.tmp
%TEMP%\aek2D2.tmp
%TEMP%\aek2D4.tmp
%TEMP%\aek2D3.tmp
%TEMP%\aek2CF.tmp
%TEMP%\aek2CB.tmp
%TEMP%\aek2CA.tmp
%TEMP%\aek2CC.tmp
%TEMP%\aek2CE.tmp
%TEMP%\aek2CD.tmp
%TEMP%\aek2D5.tmp
%TEMP%\aek2DD.tmp
%TEMP%\aek2DC.tmp
%TEMP%\aek2DE.tmp
%TEMP%\aek2E0.tmp
%TEMP%\aek2DF.tmp
%TEMP%\aek2DB.tmp
%TEMP%\aek2D7.tmp
%TEMP%\aek2D6.tmp
%TEMP%\aek2D8.tmp
%TEMP%\aek2DA.tmp
%TEMP%\aek2D9.tmp
%TEMP%\aek2BA.tmp
%TEMP%\aek2B9.tmp
%TEMP%\aek2BB.tmp
%TEMP%\aek2BD.tmp
%TEMP%\aek2BC.tmp
%TEMP%\aek2B8.tmp
%TEMP%\aek2B4.tmp
%TEMP%\aek2B3.tmp
%TEMP%\aek2B5.tmp
%TEMP%\aek2B7.tmp
%TEMP%\aek2B6.tmp
%TEMP%\aek2BE.tmp
%TEMP%\aek2C6.tmp
%TEMP%\aek2C5.tmp
%TEMP%\aek2C7.tmp
%TEMP%\aek2C9.tmp
%TEMP%\aek2C8.tmp
%TEMP%\aek2C4.tmp
%TEMP%\aek2C0.tmp
%TEMP%\aek2BF.tmp
%TEMP%\aek2C1.tmp
%TEMP%\aek2C3.tmp
%TEMP%\aek2C2.tmp
%TEMP%\aek247.tmp
%TEMP%\aek246.tmp
%TEMP%\aek248.tmp
%TEMP%\aek24A.tmp
%TEMP%\aek249.tmp
%TEMP%\aek245.tmp
%TEMP%\aek241.tmp
%TEMP%\aek240.tmp
%TEMP%\aek242.tmp
%TEMP%\aek244.tmp
%TEMP%\aek243.tmp
%TEMP%\aek24B.tmp
%TEMP%\aek253.tmp
%TEMP%\aek252.tmp
%TEMP%\aek254.tmp
%TEMP%\aek256.tmp
%TEMP%\aek255.tmp
%TEMP%\aek251.tmp
%TEMP%\aek24D.tmp
%TEMP%\aek24C.tmp
%TEMP%\aek24E.tmp
%TEMP%\aek250.tmp
%TEMP%\aek24F.tmp
%TEMP%\aek230.tmp
%TEMP%\aek22F.tmp
%TEMP%\aek231.tmp
%TEMP%\aek233.tmp
%TEMP%\aek232.tmp
%TEMP%\aek22E.tmp
%TEMP%\aek22A.tmp
%TEMP%\aek229.tmp
%TEMP%\aek22B.tmp
%TEMP%\aek22D.tmp
%TEMP%\aek22C.tmp
%TEMP%\aek234.tmp
%TEMP%\aek23C.tmp
%TEMP%\aek23B.tmp
%TEMP%\aek23D.tmp
%TEMP%\aek23F.tmp
%TEMP%\aek23E.tmp
%TEMP%\aek23A.tmp
%TEMP%\aek236.tmp
%TEMP%\aek235.tmp
%TEMP%\aek237.tmp
%TEMP%\aek239.tmp
%TEMP%\aek238.tmp
%TEMP%\aek275.tmp
%TEMP%\aek274.tmp
%TEMP%\aek276.tmp
%TEMP%\aek278.tmp
%TEMP%\aek277.tmp
%TEMP%\aek273.tmp
%TEMP%\aek26F.tmp
%TEMP%\aek26E.tmp
%TEMP%\aek270.tmp
%TEMP%\aek272.tmp
%TEMP%\aek271.tmp
%TEMP%\aek279.tmp
%TEMP%\aek281.tmp
%TEMP%\aek280.tmp
%TEMP%\aek282.tmp
%TEMP%\aek284.tmp
%TEMP%\aek283.tmp
%TEMP%\aek27F.tmp
%TEMP%\aek27B.tmp
%TEMP%\aek27A.tmp
%TEMP%\aek27C.tmp
%TEMP%\aek27E.tmp
%TEMP%\aek27D.tmp
%TEMP%\aek25E.tmp
%TEMP%\aek25D.tmp
%TEMP%\aek25F.tmp
%TEMP%\aek261.tmp
%TEMP%\aek260.tmp
%TEMP%\aek25C.tmp
%TEMP%\aek258.tmp
%TEMP%\aek257.tmp
%TEMP%\aek259.tmp
%TEMP%\aek25B.tmp
%TEMP%\aek25A.tmp
%TEMP%\aek262.tmp
%TEMP%\aek26A.tmp
%TEMP%\aek269.tmp
%TEMP%\aek26B.tmp
%TEMP%\aek26D.tmp
%TEMP%\aek26C.tmp
%TEMP%\aek268.tmp
%TEMP%\aek264.tmp
%TEMP%\aek263.tmp
%TEMP%\aek265.tmp
%TEMP%\aek267.tmp
%TEMP%\aek266.tmp
%TEMP%\aek7B.tmp
%TEMP%\aek7A.tmp
%TEMP%\aek7C.tmp
%TEMP%\aek7E.tmp
%TEMP%\aek7D.tmp
%TEMP%\aek79.tmp
%TEMP%\aek75.tmp
%TEMP%\aek74.tmp
%TEMP%\aek76.tmp
%TEMP%\aek78.tmp
%TEMP%\aek77.tmp
%TEMP%\aek7F.tmp
%TEMP%\aek87.tmp
%TEMP%\aek86.tmp
%TEMP%\aek88.tmp
%TEMP%\aek8A.tmp
%TEMP%\aek89.tmp
%TEMP%\aek85.tmp
%TEMP%\aek81.tmp
%TEMP%\aek80.tmp
%TEMP%\aek82.tmp
%TEMP%\aek84.tmp
%TEMP%\aek83.tmp
%TEMP%\aek64.tmp
%TEMP%\aek63.tmp
%TEMP%\aek65.tmp
%TEMP%\aek67.tmp
%TEMP%\aek66.tmp
%TEMP%\aek62.tmp
%TEMP%\aek5E.tmp
%TEMP%\aek5D.tmp
%TEMP%\aek5F.tmp
%TEMP%\aek61.tmp
%TEMP%\aek60.tmp
%TEMP%\aek68.tmp
%TEMP%\aek70.tmp
%TEMP%\aek6F.tmp
%TEMP%\aek71.tmp
%TEMP%\aek73.tmp
%TEMP%\aek72.tmp
%TEMP%\aek6E.tmp
%TEMP%\aek6A.tmp
%TEMP%\aek69.tmp
%TEMP%\aek6B.tmp
%TEMP%\aek6D.tmp
%TEMP%\aek6C.tmp
%TEMP%\aekA9.tmp
%TEMP%\aekA8.tmp
%TEMP%\aekAA.tmp
%TEMP%\aekAC.tmp
%TEMP%\aekAB.tmp
%TEMP%\aekA7.tmp
%TEMP%\aekA3.tmp
%TEMP%\aekA2.tmp
%TEMP%\aekA4.tmp
%TEMP%\aekA6.tmp
%TEMP%\aekA5.tmp
%TEMP%\aekAD.tmp
%TEMP%\aekB5.tmp
%TEMP%\aekB4.tmp
%TEMP%\aekB6.tmp
%TEMP%\aekB8.tmp
%TEMP%\aekB7.tmp
%TEMP%\aekB3.tmp
%TEMP%\aekAF.tmp
%TEMP%\aekAE.tmp
%TEMP%\aekB0.tmp
%TEMP%\aekB2.tmp
%TEMP%\aekB1.tmp
%TEMP%\aek92.tmp
%TEMP%\aek91.tmp
%TEMP%\aek93.tmp
%TEMP%\aek95.tmp
%TEMP%\aek94.tmp
%TEMP%\aek90.tmp
%TEMP%\aek8C.tmp
%TEMP%\aek8B.tmp
%TEMP%\aek8D.tmp
%TEMP%\aek8F.tmp
%TEMP%\aek8E.tmp
%TEMP%\aek96.tmp
%TEMP%\aek9E.tmp
%TEMP%\aek9D.tmp
%TEMP%\aek9F.tmp
%TEMP%\aekA1.tmp
%TEMP%\aekA0.tmp
%TEMP%\aek9C.tmp
%TEMP%\aek98.tmp
%TEMP%\aek97.tmp
%TEMP%\aek99.tmp
%TEMP%\aek9B.tmp
%TEMP%\aek9A.tmp
%TEMP%\aek1F.tmp
%TEMP%\aek1E.tmp
%TEMP%\aek20.tmp
%TEMP%\aek22.tmp
%TEMP%\aek21.tmp
%TEMP%\aek1D.tmp
%TEMP%\aek19.tmp
%TEMP%\aek18.tmp
%TEMP%\aek1A.tmp
%TEMP%\aek1C.tmp
%TEMP%\aek1B.tmp
%TEMP%\aek23.tmp
%TEMP%\aek2B.tmp
%TEMP%\aek2A.tmp
%TEMP%\aek2C.tmp
%TEMP%\aek2E.tmp
%TEMP%\aek2D.tmp
%TEMP%\aek29.tmp
%TEMP%\aek25.tmp
%TEMP%\aek24.tmp
%TEMP%\aek26.tmp
%TEMP%\aek28.tmp
%TEMP%\aek27.tmp
%TEMP%\aek8.tmp
%TEMP%\aek7.tmp
%TEMP%\aek9.tmp
%TEMP%\aekB.tmp
%TEMP%\aekA.tmp
%TEMP%\aek6.tmp
%TEMP%\aek2.tmp
%TEMP%\aek1.tmp
%TEMP%\aek3.tmp
%TEMP%\aek5.tmp
%TEMP%\aek4.tmp
%TEMP%\aekC.tmp
%TEMP%\aek14.tmp
%TEMP%\aek13.tmp
%TEMP%\aek15.tmp
%TEMP%\aek17.tmp
%TEMP%\aek16.tmp
%TEMP%\aek12.tmp
%TEMP%\aekE.tmp
%TEMP%\aekD.tmp
%TEMP%\aekF.tmp
%TEMP%\aek11.tmp
%TEMP%\aek10.tmp
%TEMP%\aek4D.tmp
%TEMP%\aek4C.tmp
%TEMP%\aek4E.tmp
%TEMP%\aek50.tmp
%TEMP%\aek4F.tmp
%TEMP%\aek4B.tmp
%TEMP%\aek47.tmp
%TEMP%\aek46.tmp
%TEMP%\aek48.tmp
%TEMP%\aek4A.tmp
%TEMP%\aek49.tmp
%TEMP%\aek51.tmp
%TEMP%\aek59.tmp
%TEMP%\aek58.tmp
%TEMP%\aek5A.tmp
%TEMP%\aek5C.tmp
%TEMP%\aek5B.tmp
%TEMP%\aek57.tmp
%TEMP%\aek53.tmp
%TEMP%\aek52.tmp
%TEMP%\aek54.tmp
%TEMP%\aek56.tmp
%TEMP%\aek55.tmp
%TEMP%\aek36.tmp
%TEMP%\aek35.tmp
%TEMP%\aek37.tmp
%TEMP%\aek39.tmp
%TEMP%\aek38.tmp
%TEMP%\aek34.tmp
%TEMP%\aek30.tmp
%TEMP%\aek2F.tmp
%TEMP%\aek31.tmp
%TEMP%\aek33.tmp
%TEMP%\aek32.tmp
%TEMP%\aek3A.tmp
%TEMP%\aek42.tmp
%TEMP%\aek41.tmp
%TEMP%\aek43.tmp
%TEMP%\aek45.tmp
%TEMP%\aek44.tmp
%TEMP%\aek40.tmp
%TEMP%\aek3C.tmp
%TEMP%\aek3B.tmp
%TEMP%\aek3D.tmp
%TEMP%\aek3F.tmp
%TEMP%\aek3E.tmp
%TEMP%\aek133.tmp
%TEMP%\aek132.tmp
%TEMP%\aek134.tmp
%TEMP%\aek136.tmp
%TEMP%\aek135.tmp
%TEMP%\aek131.tmp
%TEMP%\aek12D.tmp
%TEMP%\aek12C.tmp
%TEMP%\aek12E.tmp
%TEMP%\aek130.tmp
%TEMP%\aek12F.tmp
%TEMP%\aek137.tmp
%TEMP%\aek13F.tmp
%TEMP%\aek13E.tmp
%TEMP%\aek140.tmp
%TEMP%\aek142.tmp
%TEMP%\aek141.tmp
%TEMP%\aek13D.tmp
%TEMP%\aek139.tmp
%TEMP%\aek138.tmp
%TEMP%\aek13A.tmp
%TEMP%\aek13C.tmp
%TEMP%\aek13B.tmp
%TEMP%\aek11C.tmp
%TEMP%\aek11B.tmp
%TEMP%\aek11D.tmp
%TEMP%\aek11F.tmp
%TEMP%\aek11E.tmp
%TEMP%\aek11A.tmp
%TEMP%\aek116.tmp
%TEMP%\aek115.tmp
%TEMP%\aek117.tmp
%TEMP%\aek119.tmp
%TEMP%\aek118.tmp
%TEMP%\aek120.tmp
%TEMP%\aek128.tmp
%TEMP%\aek127.tmp
%TEMP%\aek129.tmp
%TEMP%\aek12B.tmp
%TEMP%\aek12A.tmp
%TEMP%\aek126.tmp
%TEMP%\aek122.tmp
%TEMP%\aek121.tmp
%TEMP%\aek123.tmp
%TEMP%\aek125.tmp
%TEMP%\aek124.tmp
%TEMP%\aek161.tmp
%TEMP%\aek160.tmp
%TEMP%\aek162.tmp
%TEMP%\aek164.tmp
%TEMP%\aek163.tmp
%TEMP%\aek15F.tmp
%TEMP%\aek15B.tmp
%TEMP%\aek15A.tmp
%TEMP%\aek15C.tmp
%TEMP%\aek15E.tmp
%TEMP%\aek15D.tmp
%TEMP%\aek165.tmp
%TEMP%\aek16D.tmp
%TEMP%\aek16C.tmp
%TEMP%\aek16E.tmp
%TEMP%\aek170.tmp
%TEMP%\aek16F.tmp
%TEMP%\aek16B.tmp
%TEMP%\aek167.tmp
%TEMP%\aek166.tmp
%TEMP%\aek168.tmp
%TEMP%\aek16A.tmp
%TEMP%\aek169.tmp
%TEMP%\aek14A.tmp
%TEMP%\aek149.tmp
%TEMP%\aek14B.tmp
%TEMP%\aek14D.tmp
%TEMP%\aek14C.tmp
%TEMP%\aek148.tmp
%TEMP%\aek144.tmp
%TEMP%\aek143.tmp
%TEMP%\aek145.tmp
%TEMP%\aek147.tmp
%TEMP%\aek146.tmp
%TEMP%\aek14E.tmp
%TEMP%\aek156.tmp
%TEMP%\aek155.tmp
%TEMP%\aek157.tmp
%TEMP%\aek159.tmp
%TEMP%\aek158.tmp
%TEMP%\aek154.tmp
%TEMP%\aek150.tmp
%TEMP%\aek14F.tmp
%TEMP%\aek151.tmp
%TEMP%\aek153.tmp
%TEMP%\aek152.tmp
%TEMP%\aekD7.tmp
%TEMP%\aekD6.tmp
%TEMP%\aekD8.tmp
%TEMP%\aekDA.tmp
%TEMP%\aekD9.tmp
%TEMP%\aekD5.tmp
%TEMP%\aekD1.tmp
%TEMP%\aekD0.tmp
%TEMP%\aekD2.tmp
%TEMP%\aekD4.tmp
%TEMP%\aekD3.tmp
%TEMP%\aekDB.tmp
%TEMP%\aekE3.tmp
%TEMP%\aekE2.tmp
%TEMP%\aekE4.tmp
%TEMP%\aekE6.tmp
%TEMP%\aekE5.tmp
%TEMP%\aekE1.tmp
%TEMP%\aekDD.tmp
%TEMP%\aekDC.tmp
%TEMP%\aekDE.tmp
%TEMP%\aekE0.tmp
%TEMP%\aekDF.tmp
%TEMP%\aekC0.tmp
%TEMP%\aekBF.tmp
%TEMP%\aekC1.tmp
%TEMP%\aekC3.tmp
%TEMP%\aekC2.tmp
%TEMP%\aekBE.tmp
%TEMP%\aekBA.tmp
%TEMP%\aekB9.tmp
%TEMP%\aekBB.tmp
%TEMP%\aekBD.tmp
%TEMP%\aekBC.tmp
%TEMP%\aekC4.tmp
%TEMP%\aekCC.tmp
%TEMP%\aekCB.tmp
%TEMP%\aekCD.tmp
%TEMP%\aekCF.tmp
%TEMP%\aekCE.tmp
%TEMP%\aekCA.tmp
%TEMP%\aekC6.tmp
%TEMP%\aekC5.tmp
%TEMP%\aekC7.tmp
%TEMP%\aekC9.tmp
%TEMP%\aekC8.tmp
%TEMP%\aek105.tmp
%TEMP%\aek104.tmp
%TEMP%\aek106.tmp
%TEMP%\aek108.tmp
%TEMP%\aek107.tmp
%TEMP%\aek103.tmp
%TEMP%\aekFF.tmp
%TEMP%\aekFE.tmp
%TEMP%\aek100.tmp
%TEMP%\aek102.tmp
%TEMP%\aek101.tmp
%TEMP%\aek109.tmp
%TEMP%\aek111.tmp
%TEMP%\aek110.tmp
%TEMP%\aek112.tmp
%TEMP%\aek114.tmp
%TEMP%\aek113.tmp
%TEMP%\aek10F.tmp
%TEMP%\aek10B.tmp
%TEMP%\aek10A.tmp
%TEMP%\aek10C.tmp
%TEMP%\aek10E.tmp
%TEMP%\aek10D.tmp
%TEMP%\aekEE.tmp
%TEMP%\aekED.tmp
%TEMP%\aekEF.tmp
%TEMP%\aekF1.tmp
%TEMP%\aekF0.tmp
%TEMP%\aekEC.tmp
%TEMP%\aekE8.tmp
%TEMP%\aekE7.tmp
%TEMP%\aekE9.tmp
%TEMP%\aekEB.tmp
%TEMP%\aekEA.tmp
%TEMP%\aekF2.tmp
%TEMP%\aekFA.tmp
%TEMP%\aekF9.tmp
%TEMP%\aekFB.tmp
%TEMP%\aekFD.tmp
%TEMP%\aekFC.tmp
%TEMP%\aekF8.tmp
%TEMP%\aekF4.tmp
%TEMP%\aekF3.tmp
%TEMP%\aekF5.tmp
%TEMP%\aekF7.tmp
%TEMP%\aekF6.tmp

Network activity:

Connects to:

'ge####reeh0st.com':80

TCP:

HTTP GET requests:

ge####reeh0st.com/setup2.exe

UDP:

DNS ASK ge####reeh0st.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial