Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\system\important.exe
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\delete.avi.exe
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\000814251_video_01.avi.exe
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\tileimage.bmp
Modifies file system
Creates the following files
- C:\system\important.exe
- %TEMP%\qgl-d0jl.0.vb
- D:\install.log.exe
- %TEMP%\resb568.tmp
- %TEMP%\vbcb567.tmp
- %TEMP%\lklnm3qt.out
- %TEMP%\lklnm3qt.cmdline
- %TEMP%\lklnm3qt.0.vb
- %PROGRAMDATA%\system\install.ico
- D:\system\important.exe
- C:\totalcmd.exe
- %TEMP%\resad0c.tmp
- %TEMP%\vbcacfb.tmp
- %TEMP%\e82_vatk.out
- %TEMP%\e82_vatk.cmdline
- %TEMP%\e82_vatk.0.vb
- C:\recovery.exe
- %TEMP%\resa897.tmp
- %TEMP%\qgl-d0jl.cmdline
- %TEMP%\vbcbb91.tmp
- %TEMP%\vbc823d.tmp
- %TEMP%\resbb92.tmp
- %TEMP%\diksonki.out
- %TEMP%\diksonki.cmdline
- %TEMP%\diksonki.0.vb
- %PROGRAMDATA%\system\dashborder_192.ico
- %TEMP%\resc566.tmp
- %TEMP%\vbcc565.tmp
- %TEMP%\kps7jaoh.out
- %TEMP%\kps7jaoh.cmdline
- %TEMP%\kps7jaoh.0.vb
- %PROGRAMDATA%\system\000814251_video_01.ico
- %TEMP%\resc074.tmp
- %TEMP%\vbcc073.tmp
- %TEMP%\0qxysydw.out
- %TEMP%\0qxysydw.cmdline
- %TEMP%\0qxysydw.0.vb
- %PROGRAMDATA%\system\delete.ico
- D:\$recycle.bin.exe
- %TEMP%\vbca896.tmp
- %TEMP%\qgl-d0jl.out
- %TEMP%\795.py
- C:\far2.exe
- %TEMP%\vbc97cd.tmp
- %TEMP%\3c9umhfe.out
- %TEMP%\3c9umhfe.cmdline
- %TEMP%\3c9umhfe.0.vb
- C:\documents and settings.exe
- %TEMP%\res93d6.tmp
- %TEMP%\vbc93d5.tmp
- %TEMP%\tywqipxr.out
- %TEMP%\tywqipxr.cmdline
- %TEMP%\tywqipxr.0.vb
- C:\$recycle.bin.exe
- %TEMP%\res8fc0.tmp
- %TEMP%\vbc8fbf.tmp
- %TEMP%\scojawek.out
- %TEMP%\scojawek.cmdline
- %TEMP%\scojawek.0.vb
- %PROGRAMDATA%\system\jtgznuupra.ico
- %TEMP%\res97de.tmp
- %TEMP%\rhkddtab.0.vb
- %TEMP%\plw_vznp.cmdline
- %TEMP%\rhkddtab.cmdline
- %TEMP%\plw_vznp.0.vb
- C:\program files.exe
- %TEMP%\resa2cb.tmp
- %TEMP%\vbca2ca.tmp
- %TEMP%\qp1y_7y8.out
- %TEMP%\qp1y_7y8.cmdline
- %TEMP%\qp1y_7y8.0.vb
- C:\perflogs.exe
- %TEMP%\res9f21.tmp
- %TEMP%\vbc9f20.tmp
- %TEMP%\2rj8u3x0.out
- %TEMP%\2rj8u3x0.cmdline
- %TEMP%\2rj8u3x0.0.vb
- C:\msocache.exe
- %TEMP%\res9b87.tmp
- %TEMP%\vbc9b77.tmp
- %TEMP%\rhkddtab.out
- %TEMP%\plw_vznp.out
- %TEMP%\res823e.tmp
Sets the 'hidden' attribute to the following files
- C:\system\important.exe
- D:\system\important.exe
- <Drive name for removable media>:\system\important.exe
Deletes the following files
- %TEMP%\res8fc0.tmp
- %TEMP%\plw_vznp.0.vb
- %TEMP%\resad0c.tmp
- %TEMP%\vbcacfb.tmp
- %TEMP%\e82_vatk.out
- %TEMP%\e82_vatk.cmdline
- %TEMP%\e82_vatk.0.vb
- %TEMP%\resb568.tmp
- %TEMP%\vbcb567.tmp
- %TEMP%\lklnm3qt.cmdline
- %TEMP%\lklnm3qt.out
- %TEMP%\lklnm3qt.0.vb
- %TEMP%\resbb92.tmp
- %TEMP%\vbcbb91.tmp
- %TEMP%\qgl-d0jl.cmdline
- %TEMP%\qgl-d0jl.0.vb
- %TEMP%\qgl-d0jl.out
- %TEMP%\resc074.tmp
- %TEMP%\vbcc073.tmp
- %TEMP%\0qxysydw.0.vb
- %TEMP%\0qxysydw.cmdline
- %TEMP%\0qxysydw.out
- %TEMP%\resc566.tmp
- %TEMP%\vbcc565.tmp
- %TEMP%\kps7jaoh.0.vb
- %TEMP%\kps7jaoh.out
- %TEMP%\kps7jaoh.cmdline
- %TEMP%\res823e.tmp
- %TEMP%\vbc823d.tmp
- %TEMP%\diksonki.cmdline
- %TEMP%\plw_vznp.cmdline
- %TEMP%\diksonki.out
- %TEMP%\plw_vznp.out
- %TEMP%\resa897.tmp
- %TEMP%\vbc8fbf.tmp
- %TEMP%\scojawek.out
- %TEMP%\scojawek.0.vb
- %TEMP%\scojawek.cmdline
- %TEMP%\res93d6.tmp
- %TEMP%\vbc93d5.tmp
- %TEMP%\tywqipxr.0.vb
- %TEMP%\tywqipxr.out
- %TEMP%\tywqipxr.cmdline
- %TEMP%\res97de.tmp
- %TEMP%\vbc97cd.tmp
- %TEMP%\3c9umhfe.0.vb
- %TEMP%\3c9umhfe.cmdline
- %TEMP%\3c9umhfe.out
- %TEMP%\res9b87.tmp
- %TEMP%\vbc9b77.tmp
- %TEMP%\rhkddtab.0.vb
- %TEMP%\rhkddtab.cmdline
- %TEMP%\rhkddtab.out
- %TEMP%\res9f21.tmp
- %TEMP%\vbc9f20.tmp
- %TEMP%\2rj8u3x0.0.vb
- %TEMP%\2rj8u3x0.out
- %TEMP%\2rj8u3x0.cmdline
- %TEMP%\resa2cb.tmp
- %TEMP%\vbca2ca.tmp
- %TEMP%\qp1y_7y8.cmdline
- %TEMP%\qp1y_7y8.0.vb
- %TEMP%\qp1y_7y8.out
- %TEMP%\vbca896.tmp
- %TEMP%\diksonki.0.vb
Network activity
Connects to
- 'localhost':333
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\scojawek.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\diksonki.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC566.tmp" "%TEMP%\vbcC565.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kps7jaoh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC074.tmp" "%TEMP%\vbcC073.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0qxysydw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB92.tmp" "%TEMP%\vbcBB91.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qgl-d0jl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB568.tmp" "%TEMP%\vbcB567.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lklnm3qt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAD0C.tmp" "%TEMP%\vbcACFB.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e82_vatk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES823E.tmp" "%TEMP%\vbc823D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA897.tmp" "%TEMP%\vbcA896.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA2CB.tmp" "%TEMP%\vbcA2CA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qp1y_7y8.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9F21.tmp" "%TEMP%\vbc9F20.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2rj8u3x0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9B87.tmp" "%TEMP%\vbc9B77.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rhkddtab.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES97DE.tmp" "%TEMP%\vbc97CD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3c9umhfe.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES93D6.tmp" "%TEMP%\vbc93D5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tywqipxr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8FC0.tmp" "%TEMP%\vbc8FBF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\plw_vznp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\czbtaeac.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\scojawek.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\diksonki.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC566.tmp" "%TEMP%\vbcC565.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kps7jaoh.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC074.tmp" "%TEMP%\vbcC073.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0qxysydw.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB92.tmp" "%TEMP%\vbcBB91.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qgl-d0jl.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB568.tmp" "%TEMP%\vbcB567.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lklnm3qt.cmdline"
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %TEMP%\795.py
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAD0C.tmp" "%TEMP%\vbcACFB.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e82_vatk.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA897.tmp" "%TEMP%\vbcA896.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\plw_vznp.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA2CB.tmp" "%TEMP%\vbcA2CA.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qp1y_7y8.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9F21.tmp" "%TEMP%\vbc9F20.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2rj8u3x0.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9B87.tmp" "%TEMP%\vbc9B77.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rhkddtab.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES97DE.tmp" "%TEMP%\vbc97CD.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3c9umhfe.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES93D6.tmp" "%TEMP%\vbc93D5.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tywqipxr.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8FC0.tmp" "%TEMP%\vbc8FBF.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES823E.tmp" "%TEMP%\vbc823D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\czbtaeac.cmdline"
