Trojan.DownLoader1.7000

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'lsass' = '%WINDIR%\alg.exe'

Infects the following executable files

C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe
%CommonProgramFiles(x86)%\java\java update\jaureg.exe
%CommonProgramFiles(x86)%\adobe\arm\1.0\armsvc.exe
%CommonProgramFiles(x86)%\adobe\arm\1.0\adobearmhelper.exe
%CommonProgramFiles(x86)%\adobe\arm\1.0\adobearm.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\wow_helper.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\reader_sl.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\64bitmapibroker.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logtransport2.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\eula.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\arh.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwtrig20.exe
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dw20.exe
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.exe
%CommonProgramFiles(x86)%\java\java update\jucheck.exe
%CommonProgramFiles(x86)%\java\java update\jusched.exe

Modifies file system

Creates the following files

%WINDIR%\temp\<File name>.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ff.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx350f.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3520.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3521.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3541.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3552.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3563.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3573.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3584.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3585.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3595.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35b6.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35b7.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35c7.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35c8.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35d9.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35ea.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35fa.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35fb.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx360c.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx361c.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx361d.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx362e.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx363f.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3640.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3650.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3661.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ee.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3662.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34de.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ad.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5638.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5639.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5659.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5679.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx568a.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx569b.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx569c.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56ac.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56bd.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56dd.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56ee.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56fe.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56ff.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5710.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5721.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5722.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5732.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5743.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5753.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5764.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5775.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5776.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5786.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx347a.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx347b.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx349b.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ac.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34cd.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4852.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4aa3.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
%CommonProgramFiles(x86)%\java\java update\rcx4884.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4895.tmp
%CommonProgramFiles(x86)%\java\java update\rcx48c5.tmp
%CommonProgramFiles(x86)%\java\java update\rcx48d5.tmp
%CommonProgramFiles(x86)%\java\java update\rcx48f6.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4906.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4917.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4937.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4948.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4958.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4969.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4989.tmp
%CommonProgramFiles(x86)%\java\java update\rcx49aa.tmp
%CommonProgramFiles(x86)%\java\java update\rcx49ba.tmp
%CommonProgramFiles(x86)%\java\java update\rcx49cb.tmp
%CommonProgramFiles(x86)%\java\java update\rcx49db.tmp
%CommonProgramFiles(x86)%\java\java update\rcx49ec.tmp
%CommonProgramFiles(x86)%\java\java update\rcx49fd.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a0d.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a1e.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a1f.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a30.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a40.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a41.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a52.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a53.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4a92.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4874.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5627.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4873.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4851.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3ef0.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f01.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f12.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f13.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f23.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f34.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f45.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f55.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f66.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3fb5.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3fc6.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3fd6.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3fe7.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3ff7.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx4008.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx4019.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx4029.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx403a.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx406a.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\rcx407a.tmp
%CommonProgramFiles(x86)%\java\java update\alg.exe
%CommonProgramFiles(x86)%\java\java update\rcx47ee.tmp
%CommonProgramFiles(x86)%\java\java update\rcx47ef.tmp
%CommonProgramFiles(x86)%\java\java update\rcx47ff.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4820.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4821.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4831.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3673.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3683.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5617.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23ef.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21af.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21c0.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21d1.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21e1.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2202.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2203.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2223.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2233.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2244.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2255.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx22f2.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2303.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2313.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2314.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2325.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2335.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2346.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2347.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2358.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2368.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2379.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx237a.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx238b.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx238c.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx239c.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23ad.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23bd.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx219f.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23ce.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx218e.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx216d.tmp
C:\lsass.aaa
%TEMP%\dw.log
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx1fde.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx1ffe.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx200f.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2010.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2020.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2031.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2032.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2043.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2053.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2064.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2094.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20a4.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20a5.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20c6.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20c7.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20d7.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20e8.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20f9.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2109.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx211a.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx212a.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx213b.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx214c.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx215c.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx217e.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49d2.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55f5.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23f0.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49f4.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx4a15.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx4a25.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4beb.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c0c.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c1c.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c4c.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c5d.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c7d.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c9d.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4cae.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4cce.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4cdf.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4dbb.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4dcb.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx554e.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx556e.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx556f.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5580.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5591.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55a1.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55b2.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55c2.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55d3.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55e4.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55f4.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49f3.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5606.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49d3.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49c2.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2401.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2412.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2422.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2433.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2434.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2444.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2455.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2456.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2467.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2477.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2478.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2489.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx249a.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24ba.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24ca.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24cb.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24dc.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b17.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b27.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b38.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b39.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b4a.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b5a.tmp
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49b1.tmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23cf.tmp
%CommonProgramFiles(x86)%\java\java update\rcx4ab4.tmp

Deletes the following files

%WINDIR%\temp\adobearm.log
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
%WINDIR%\temp\8147932992814195939363050711163993686\adobearm.exe
%WINDIR%\temp\ts_8e67.tmp
%WINDIR%\temp\ts_77d1.tmp
%WINDIR%\temp\ts_5080.tmp
%WINDIR%\temp\ts_4f66.tmp
%WINDIR%\temp\ts_39ba.tmp
%WINDIR%\temp\ts_3852.tmp
%WINDIR%\temp\ts_361e.tmp
%WINDIR%\temp\ts_316a.tmp
%WINDIR%\temp\ts_2bfb.tmp
%WINDIR%\temp\ts_2b0f.tmp
%WINDIR%\temp\ts_267a.tmp
%WINDIR%\temp\fxstiffdebuglogfile.txt
%WINDIR%\temp\fxsapidebuglogfile.txt
%WINDIR%\temp\<File name>.exe
%WINDIR%\temp\dmi8538.tmp
%CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
%CommonProgramFiles(x86)%\java\java update\alg.exe

Moves the following files

from C:\lsass.aaa to %WINDIR%\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3520.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3521.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3541.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3552.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3563.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3573.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3584.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3585.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3595.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35b6.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ff.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx350f.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35b7.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35d9.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35ea.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35fa.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35fb.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx360c.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx361c.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx361d.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx362e.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx363f.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3640.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35c7.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx35c8.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ee.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34cd.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3661.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx568a.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx569b.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx569c.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56ac.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56bd.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56dd.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56ee.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56fe.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx56ff.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5710.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5721.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5722.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5732.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5743.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5753.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5764.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5775.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5776.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5786.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx347b.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx349b.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ac.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34ad.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3650.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5659.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx34de.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49d3.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3662.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4884.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4895.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx48d5.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx48f6.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4906.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4917.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4937.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4948.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4958.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4969.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4989.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx49aa.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx49ba.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx49cb.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx49db.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx49ec.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx49fd.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a0d.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a1e.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a1f.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a30.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a40.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a41.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a52.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4a53.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4874.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5639.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5679.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4851.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3683.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3ef0.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f01.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f12.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f13.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f23.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f34.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f45.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f55.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3f66.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3fc6.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3fd6.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3fe7.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx3ff7.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx4008.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx4019.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx4029.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx403a.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\adobe\arm\1.0\rcx407a.tmp to %CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx47ee.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx47ef.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx47ff.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4820.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4821.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4831.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4852.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx3673.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5638.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5627.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5617.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21e1.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2202.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2203.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2223.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2233.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2244.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2255.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2303.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2313.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2314.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2325.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2335.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2346.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2347.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2358.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2368.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2379.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx237a.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx238b.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx238c.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx239c.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23ad.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23bd.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21af.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx218e.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21d1.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4aa3.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23ce.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx217e.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx1ffe.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx200f.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2010.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2020.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2031.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2032.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2043.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2053.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2064.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2094.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20a4.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx1fde.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20a5.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20c7.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20d7.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20e8.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20f9.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2109.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx211a.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx212a.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx213b.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx214c.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx215c.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx216d.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx20c6.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx219f.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4873.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23cf.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2401.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx4a25.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c0c.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c1c.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c4c.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c5d.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c7d.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4c9d.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4cae.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4cce.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4cdf.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rcx4dcb.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx554e.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx556e.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx556f.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5580.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5591.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55a1.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55b2.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55c2.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55d3.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55e4.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55f4.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx55f5.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\rcx5606.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23ef.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx4a15.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx23f0.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49f4.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx21c0.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2412.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2422.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2433.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2434.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2444.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2455.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2456.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2467.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2477.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2478.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx2489.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx249a.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24ba.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24ca.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24cb.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\rcx24dc.tmp to C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b17.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b27.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b38.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b39.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b4a.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\rcx2b5a.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49b1.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49c2.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49d2.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rcx49f3.tmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
from %CommonProgramFiles(x86)%\java\java update\rcx4ab4.tmp to %CommonProgramFiles(x86)%\java\java update\alg.exe

Substitutes the following files

C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\alg.exe
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\alg.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\alg.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\alg.exe
%CommonProgramFiles(x86)%\adobe\arm\1.0\alg.exe
%CommonProgramFiles(x86)%\java\java update\alg.exe

Network activity

UDP

DNS ASK 36###nyu.com

Miscellaneous

Creates and executes the following

'%WINDIR%\temp\<File name>.exe'
'%WINDIR%\alg.exe'
'%WINDIR%\temp\<File name>.exe' ' (with hidden window)
'%WINDIR%\alg.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del %WINDIR%\temp\*.* /q /s' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c del %WINDIR%\temp\*.* /q /s

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней