Trojan.DownLoader35.6110

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop xlkfs

Modifies file system

Creates the following files

%WINDIR%\jie.dll
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i5daybk.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ilt1xow.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$isr9gal.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$imst9n0.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iyznd77.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iwnieqy.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iqmzbuz.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i8mwtyb.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i167y4l.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iuclywr.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i9hmo7i.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$it581go.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ivlxk22.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ifh1s6x.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$itwvwkq.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i84p1gr.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ioh6jmt.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i57e3on.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$in9zcym.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$isytegd.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ivk9afj.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iiiqbl6.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iozb1rd.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iatd0hi.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$isfkmq0.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ilv6bfe.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ia8uv9k.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$im00tug.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$imcbrsj.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ibhfiq9.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ifjfzqu.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ibupgrz.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i4o1d4g.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i59znx9.db
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iybl0gt.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i925n31.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ipeauj1.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$il6htbj.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$inxydn6.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ii7jdxx.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ijrprxe.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ijyw2nq.ini
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ijk3m1e.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iypwh7u.db
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ik52p7z.db
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iv133kw.db
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iin7h8a.db
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ioezbuy.db
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iibomtr.db
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i6q7gc5.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$icoctqw.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$irzv2au.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i4i1l5p.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i3hpqpz.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i0hfhd7.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i0x50dz.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iv62n91.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iykgs4o.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ixbqs87.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ivbrcg4.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i1l4yps.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iaur8xe.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$il3j60j.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ixd621p.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i5n3113.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i3sh8cu.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ieohjys.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iojd2qp.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i84qrqw.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i5yi3s0.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iqg12xw.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iwarma4.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iigf6gp.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ip7kyad.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i3d00pv.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ildjtwr.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i7454f4.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i2htqoz.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iwhbjg9.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$imd5luq.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i9ntu9e.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$icdowhy.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iyn2kz3.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$izfjb6s.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ilbpce0.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i3pn1lc.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iy0eyet.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i8km9hr.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iprhhrr.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$im0n0kp.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ijxmm6s.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i7ylolo.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i2lx9c2.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ih1ah21.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ilcd3m7.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ihjvqxe.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i0d1pyh.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ifu0xpw.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$icd6xng.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i4aiuem.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$izg9cs6.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i1cw3mp.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$izopllm.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i14azbj.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i111nmp.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i4ijpbu.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iyonr7l.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$idn4tv3.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i753mmh.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$is778ib.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ik497n1.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i1wx1gz.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ia98l0n.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ifrb1eb.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ihxvzni.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i5s1y15.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i2dij18.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iaqjpzs.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$igxd1p6.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iqievj9.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ibl9jng.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ir2tm9e.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i19qxrb.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iwqx6vi.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$inaqg3i.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ilbk507.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iel7tlc.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$idsvwu0.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i1s7cry.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ivjr4z2.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$isj3v3x.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i8vflvi.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ifvpdno.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iccrrj7.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$istx3lx.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ivvizoi.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$ilsvxaj.pf
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iz7g489.db

Deletes the following files

%WINDIR%\prefetch\1.exe-bf9d2cef.pf
%WINDIR%\prefetch\taskeng.exe-48d4e289.pf
%WINDIR%\prefetch\taskhost.exe-7238f31d.pf
%WINDIR%\prefetch\test_msvcp100.exe-93b75347.pf
%WINDIR%\prefetch\test_msvcp100.exe-d47ff5f1.pf
%WINDIR%\prefetch\test_msvcp100d_x64.exe-24890c8a.pf
%WINDIR%\prefetch\test_msvcp100_x64.exe-6e02575e.pf
%WINDIR%\prefetch\test_msvcp110.exe-f929c484.pf
%WINDIR%\prefetch\test_msvcp120d.exe-ed7dfbed.pf
%WINDIR%\prefetch\test_msvcp110d.exe-6c7e6cb8.pf
%WINDIR%\prefetch\test_msvcp110d.exe-dd6c4bd2.pf
%WINDIR%\prefetch\test_msvcp110d_x64.exe-6afaa41f.pf
%WINDIR%\prefetch\test_msvcp110_x64.exe-600927fb.pf
%WINDIR%\prefetch\test_msvcp120.exe-5e9c35c1.pf
%WINDIR%\prefetch\test_msvcp120.exe-9f64d86b.pf
%WINDIR%\prefetch\test_msvcp110.exe-39f2672e.pf
%WINDIR%\prefetch\test_msvcp120d.exe-5e6bdb07.pf
%WINDIR%\prefetch\svchost.exe-7ac6742a.pf
%WINDIR%\prefetch\steamwebhelper.exe-93613764.pf
%WINDIR%\prefetch\sppsvc.exe-b0f8131b.pf
%WINDIR%\prefetch\setup_wm.exe-d33fd27d.pf
%WINDIR%\prefetch\setup.exe-f034c93c.pf
%WINDIR%\prefetch\setup.exe-d0f6149e.pf
%WINDIR%\prefetch\setup.exe-7c026c7f.pf
%WINDIR%\prefetch\schtasks.exe-5ca45734.pf
%WINDIR%\prefetch\sc.exe-945d79ae.pf
%WINDIR%\prefetch\regtlib.exe-e21980a2.pf
%WINDIR%\prefetch\regsvcs.exe-a54ad617.pf
%WINDIR%\prefetch\regedit.exe-90feea06.pf
%WINDIR%\prefetch\rdrcef.exe-5852a8de.pf
%WINDIR%\prefetch\powerpnt.exe-158b76a4.pf
%WINDIR%\prefetch\systempropertiesadvanced.exe-68c7c4f0.pf
%WINDIR%\prefetch\msconfig.exe-3a52734e.pf
%WINDIR%\prefetch\test_msvcp120d_x64.exe-b16c3bb4.pf
%WINDIR%\prefetch\aggluad_p_s-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\prefetch\wevtutil.exe-ef5861c4.pf
%WINDIR%\prefetch\winword.exe-778f7c2b.pf
%WINDIR%\prefetch\wmiadap.exe-f8dfdfa2.pf
%WINDIR%\prefetch\wmiprvse.exe-1628051c.pf
%WINDIR%\prefetch\wmiprvse.exe-6768a320.pf
%WINDIR%\prefetch\wmplayer.exe-26c72a86.pf
%WINDIR%\prefetch\_iu14d2n.tmp-74616ced.pf
%WINDIR%\prefetch\test_msvcp120xp.exe-d7d05439.pf
%WINDIR%\prefetch\layout.ini
%WINDIR%\prefetch\agapplaunch.db
%WINDIR%\prefetch\agcx_sc4.db
%WINDIR%\prefetch\agglfaulthistory.db
%WINDIR%\prefetch\agglfgapphistory.db
%WINDIR%\prefetch\agglglobalhistory.db
%WINDIR%\prefetch\wevtutil.exe-400d93e8.pf
%WINDIR%\prefetch\wermgr.exe-0f2ac88c.pf
%WINDIR%\prefetch\test_msvcp140.exe-6a49bae5.pf
%WINDIR%\prefetch\test_msvcp90_x64.exe-cf1ecfbe.pf
%WINDIR%\prefetch\werfault.exe-e69f695a.pf
%WINDIR%\prefetch\vssvc.exe-b8afc319.pf
%WINDIR%\prefetch\vs7jit.exe-aef49c84.pf
%WINDIR%\prefetch\unins000.exe-53663602.pf
%WINDIR%\prefetch\trustedinstaller.exe-3cc531e5.pf
%WINDIR%\prefetch\svchost.exe-80f4a784.pf
%WINDIR%\prefetch\triggerkms.exe-7e8edfdc.pf
%WINDIR%\prefetch\pcaui.exe-3e82c312.pf
%WINDIR%\prefetch\test_msvcp140_x64.exe-361d99d2.pf
%WINDIR%\prefetch\test_msvcp140xp.exe-6d280b1d.pf
%WINDIR%\prefetch\test_msvcp140d_xp.exe-b04bc36c.pf
%WINDIR%\prefetch\test_msvcp140d_x64.exe-3e4f6ade.pf
%WINDIR%\prefetch\test_msvcp140d.exe-606af971.pf
%WINDIR%\prefetch\test_msvcp90.exe-29c5da51.pf
%WINDIR%\prefetch\osppsvc.exe-e53d3cc0.pf
%WINDIR%\prefetch\ose00001.exe-3da4b844.pf
%WINDIR%\prefetch\ose.exe-533d8ac9.pf
%WINDIR%\prefetch\dllhost.exe-861f96f8.pf
%WINDIR%\prefetch\kmsnano_setup.exe-631a87c6.pf
%WINDIR%\prefetch\javaw.exe-dccf0ab8.pf
%WINDIR%\prefetch\ipconfig.exe-912f3d5b.pf
%WINDIR%\prefetch\install.exe-455f2d9b.pf
%WINDIR%\prefetch\iexplore.exe-4b6c9213.pf
%WINDIR%\prefetch\flashplayerupdateservice.exe-216d9c35.pf
%WINDIR%\prefetch\firefox.exe-18acfcff.pf
%WINDIR%\prefetch\explorer.exe-a80e4f97.pf
%WINDIR%\prefetch\excel.exe-53a22446.pf
%WINDIR%\prefetch\drvinst.exe-4cb4314a.pf
%WINDIR%\prefetch\dotnetfx.exe-fe16be11.pf
%WINDIR%\prefetch\dllhost.exe-ecb71776.pf
%WINDIR%\prefetch\dllhost.exe-d58da3a6.pf
%WINDIR%\prefetch\dllhost.exe-b2eb1806.pf
%WINDIR%\prefetch\dllhost.exe-7faa2e4c.pf
%WINDIR%\prefetch\conhost.exe-1f3e9d7e.pf
%WINDIR%\prefetch\dllhost.exe-766398d2.pf
%WINDIR%\prefetch\dllhost.exe-5e46fa0d.pf
%WINDIR%\prefetch\dexplore.exe-1749d792.pf
%WINDIR%\prefetch\defrag.exe-588f90ad.pf
%WINDIR%\prefetch\dbgclr.exe-ad18e06e.pf
%WINDIR%\prefetch\control.exe-817f8f1d.pf
%WINDIR%\prefetch\aggluad_s-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\prefetch\cmd.exe-4a81b364.pf
%WINDIR%\prefetch\bcssync.exe-3f6c64a2.pf
%WINDIR%\prefetch\audiodg.exe-bdfd3029.pf
%WINDIR%\prefetch\aspnet_regiis.exe-b76f1ad7.pf
%WINDIR%\prefetch\arh.exe-f07e6c2c.pf
%WINDIR%\prefetch\addinutil.exe-fef23417.pf
%WINDIR%\prefetch\acrord32.exe-acf2947d.pf
%WINDIR%\prefetch\launcher.exe-e41e51ee.pf
%WINDIR%\prefetch\wmpnscfg.exe-fc0d39bf.pf
%WINDIR%\prefetch\logonui.exe-09140401.pf
%WINDIR%\prefetch\msidf38.tmp-4231cf8d.pf
%WINDIR%\prefetch\netsh.exe-f1b6da12.pf
%WINDIR%\prefetch\msif1a9.tmp-fa1ca0e9.pf
%WINDIR%\prefetch\msohtmed.exe-35a8ca79.pf
%WINDIR%\prefetch\msohtmed.exe-68e5ab1e.pf
%WINDIR%\prefetch\msoxmled.exe-e473a01d.pf
%WINDIR%\prefetch\mstsc.exe-5283258e.pf
%WINDIR%\prefetch\mstsc.exe-76a46e8a.pf
%WINDIR%\prefetch\ngen.exe-7900743e.pf
%WINDIR%\prefetch\kmsnano_setup.tmp-11a1562c.pf
%WINDIR%\prefetch\ngen.exe-ae594a6b.pf
%WINDIR%\prefetch\ngen.exe-ec3f9239.pf
%WINDIR%\prefetch\ntosboot-b00dfaad.pf
%WINDIR%\prefetch\opera.exe-9dd4e019.pf
%WINDIR%\prefetch\opera_crashreporter.exe-e30ebed0.pf
%WINDIR%\prefetch\ose.exe-51c16f0e.pf
%WINDIR%\prefetch\msiexec.exe-e09a077a.pf
%WINDIR%\prefetch\msiexec.exe-a2d55cb6.pf
%WINDIR%\prefetch\msi6837.tmp-63debe2c.pf
%WINDIR%\prefetch\msi419f.tmp-b24cc418.pf
%WINDIR%\prefetch\msdtc.exe-cc1dec77.pf
%WINDIR%\prefetch\mscorsvw.exe-c3c515bd.pf
%WINDIR%\prefetch\mscorsvw.exe-57d17daf.pf
%WINDIR%\prefetch\mofcomp.exe-fde76efc.pf
%WINDIR%\prefetch\mdm.exe-ea9906df.pf
%WINDIR%\prefetch\manageddbgca.exe-6ea1439b.pf
%WINDIR%\prefetch\mmc.exe-f5dc4f82.pf
%WINDIR%\prefetch\mmc.exe-f39cded6.pf
%WINDIR%\prefetch\mmc.exe-53159585.pf
%WINDIR%\prefetch\migpolwin.exe-79e606fc.pf
%WINDIR%\prefetch\microsoft toolkit.exe-9dae6a40.pf
%WINDIR%\prefetch\msieb32.tmp-a0d60608.pf
%WINDIR%\prefetch\mofcomp.exe-8fe3d558.pf
%WINDIR%\prefetch\agrobust.db

Moves the following files

from %WINDIR%\jie.dll to %TEMP%\edg8e\....\jie

Moves itself

from <Full path to file> to %TEMP%\g444e\....\jie

Network activity

TCP

HTTP GET requests

http://47.##1.191.149/qudong/qudongxiafadeddll.txt
http://no##.youdao.com/yws/public/resource/b57659b50e5a7636253ba620c500c580/xmlnote/FD3DA4E8277145679B12C27A10D9C4F0/6109

UDP

DNS ASK no##.youdao.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: '#32770' WindowName: 'Easy File Locker 2.2 Uninstall'

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c net stop xlkfs' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c sc delete xlkfs' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c net stop xlkfs
'%WINDIR%\syswow64\net1.exe' stop xlkfs
'%WINDIR%\syswow64\cmd.exe' /c sc delete xlkfs
'%WINDIR%\syswow64\sc.exe' delete xlkfs

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней