HKCR\CLSID\{1D6A5EE5-2D25-4D81-A94F-F8E694A1BADF}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D6A5EE5-2D25-4D81-A94F-F8E694A1BADF}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{20C28584-8F10-4D92-987C-0A1008E2435A}

HKCR\CLSID\{F99BD4F5-D402-4c21-A8BC-510830B6BE37}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F99BD4F5-D402-4C21-A8BC-510830B6BE37}

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Qanowovo
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load
C:\Users\Vera\AppData\Roaming\Yxiq\loow.exe
C:\Users\Vera\Local Settings\Temp\msaaytzwo.exe
C:\Users\Vera\AppData\Local\Temp\000504c0.exe
C:\Users\Vera\AppData\Local\Temp\tmpd5bbe362.exe
C:\Users\Vera\AppData\Local\Temp\tmp186729cf\volumeup.exe
C:\Users\Vera\AppData\Roaming\Bahoe\uleg.exe
C:\Users\Vera\Local Settings\Temp\msayukyut.pif

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load

HKCR\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InProcServer32|
C:\$Recycle.Bin\S-1-5-21-3398080335-3982763584-750767708-1000\$c9c451169c1004d6b731c9edb951f7d4\n
C:\$Recycle.Bin\S-1-5-21-3398080335-3982763584-750767708-1000\$c9c451169c1004d6b731c9edb951f7d4\U\00000001.@

C:\skhfushjfls
C:\skhfushjfls\config.bin

C:\ProgramData\ms00051C36.dat
C:\ProgramData\t8SGJ8kk.exe
C:\Users\Vera\AppData\Local\Temp\0004e7de.exe

C:\Users\Vera\AppData\Local\Temp\0004b75c.exe
C:\Users\Vera\AppData\Local\Temp\msimg32.dll

C:\Users\Vera\AppData\Local\Temp\0004ced2.exe

C:\Users\Vera\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk