Trojan.DownLoader11.40021

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%TEMP%\aion.exe'
'%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
'%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

<Current directory>\xIUE.ico
<Current directory>\jgAe.exe
C:\RCX5D.tmp
<Current directory>\XUgs.ico
<Current directory>\TAAY.exe
C:\RCX5C.tmp
<Current directory>\Pgos.ico
<Current directory>\aUYy.exe
C:\RCX5F.tmp
<Current directory>\Ugoy.ico
<Current directory>\icAw.exe
C:\RCX5E.tmp
<Current directory>\UgkU.ico
C:\RCX58.tmp
<Current directory>\vIsm.ico
<Current directory>\sEok.exe
C:\RCX57.tmp
<Current directory>\joEU.ico
<Current directory>\JQUE.exe
C:\RCX59.tmp
<Current directory>\icEw.ico
<Current directory>\GgEy.exe
C:\RCX5B.tmp
<Current directory>\MYgU.ico
<Current directory>\uUww.exe
C:\RCX5A.tmp
C:\RCX65.tmp
<Current directory>\rEII.ico
<Current directory>\MUsM.exe
C:\RCX64.tmp
<Current directory>\qEEA.ico
<Current directory>\GwoS.exe
C:\RCX66.tmp
<Current directory>\KcYW.ico
<Current directory>\vEso.exe
C:\RCX68.tmp
<Current directory>\VIwE.ico
<Current directory>\WYsE.exe
C:\RCX67.tmp
<Current directory>\UMYS.exe
C:\RCX61.tmp
<Current directory>\LkYi.ico
<Current directory>\CYYk.exe
C:\RCX60.tmp
<Current directory>\iAIK.ico
<Current directory>\usAI.exe
C:\RCX63.tmp
<Current directory>\jokG.ico
<Current directory>\IAAS.exe
C:\RCX62.tmp
<Current directory>\JIEO.ico
<Current directory>\JgAc.exe
<Current directory>\bock.exe
<Current directory>\EAEk.exe
C:\RCX4B.tmp
<Current directory>\skAY.ico
<Current directory>\pQkU.exe
C:\RCX4A.tmp
<Current directory>\sYIg.ico
<Current directory>\hcwY.exe
C:\RCX4D.tmp
<Current directory>\ZQUK.ico
<Current directory>\DYwK.exe
C:\RCX4C.tmp
<Current directory>\FAwe.ico
<Current directory>\hEgs.exe
<Current directory>\jsQG.ico
<Current directory>\CAIO.exe
C:\RCX47.tmp
<Current directory>\MQsy.ico
<Current directory>\Bosi.exe
C:\RCX46.tmp
<Current directory>\JQko.ico
<Current directory>\twkm.exe
C:\RCX49.tmp
<Current directory>\LAwY.ico
<Current directory>\wEgA.exe
C:\RCX48.tmp
<Current directory>\tIgY.ico
<Current directory>\NQgk.ico
<Current directory>\gEEe.exe
C:\RCX54.tmp
<Current directory>\acki.ico
<Current directory>\Ukgq.exe
C:\RCX53.tmp
<Current directory>\DUIo.ico
<Current directory>\eYse.exe
C:\RCX56.tmp
<Current directory>\IQgs.ico
<Current directory>\TUwm.exe
C:\RCX55.tmp
<Current directory>\mIAE.ico
C:\RCX4F.tmp
<Current directory>\zYkU.ico
<Current directory>\eggQ.exe
C:\RCX4E.tmp
<Current directory>\PAwS.ico
<Current directory>\Dksq.exe
C:\RCX50.tmp
<Current directory>\Rggq.ico
<Current directory>\kAQs.exe
C:\RCX52.tmp
<Current directory>\uwQM.ico
<Current directory>\KQAW.exe
C:\RCX51.tmp
<Current directory>\AcUW.ico
<Current directory>\ZIws.exe
C:\RCX80.tmp
<Current directory>\vAwK.ico
<Current directory>\iogM.exe
C:\RCX7F.tmp
<Current directory>\ZIoA.ico
<Current directory>\ZMAm.exe
C:\RCX82.tmp
<Current directory>\AssK.ico
<Current directory>\TQIq.exe
C:\RCX81.tmp
<Current directory>\kwAw.ico
C:\RCX7B.tmp
<Current directory>\mUos.ico
<Current directory>\AscA.exe
C:\RCX7A.tmp
<Current directory>\DkQE.ico
<Current directory>\kEww.exe
C:\RCX7C.tmp
<Current directory>\hEIy.ico
<Current directory>\TMoK.exe
C:\RCX7E.tmp
<Current directory>\owIa.ico
<Current directory>\Qcoq.exe
C:\RCX7D.tmp
C:\RCX88.tmp
<Current directory>\jEkM.ico
<Current directory>\XkoC.exe
C:\RCX87.tmp
<Current directory>\VYEm.ico
<Current directory>\HkcG.exe
C:\RCX89.tmp
<Current directory>\YgsA.ico
<Current directory>\jQAq.exe
C:\RCX8B.tmp
<Current directory>\zYkk.ico
<Current directory>\ooUi.exe
C:\RCX8A.tmp
<Current directory>\ocAo.exe
C:\RCX84.tmp
<Current directory>\esQK.ico
<Current directory>\YkQo.exe
C:\RCX83.tmp
<Current directory>\NYIw.ico
<Current directory>\Xskm.exe
C:\RCX86.tmp
<Current directory>\SYog.ico
<Current directory>\wscS.exe
C:\RCX85.tmp
<Current directory>\pgIm.ico
<Current directory>\xkAM.exe
<Current directory>\ekUk.exe
<Current directory>\SwQg.exe
C:\RCX6E.tmp
<Current directory>\eUMo.ico
<Current directory>\cIcQ.exe
C:\RCX6D.tmp
<Current directory>\xMkE.ico
<Current directory>\LUAo.exe
C:\RCX70.tmp
<Current directory>\dMQk.ico
<Current directory>\cMou.exe
C:\RCX6F.tmp
<Current directory>\Pwwg.ico
<Current directory>\gcQI.exe
<Current directory>\zgQo.ico
<Current directory>\nMYy.exe
C:\RCX6A.tmp
<Current directory>\WccY.ico
<Current directory>\Gkki.exe
C:\RCX69.tmp
<Current directory>\MMwY.ico
<Current directory>\ZoEs.exe
C:\RCX6C.tmp
<Current directory>\Lwgo.ico
<Current directory>\UcIW.exe
C:\RCX6B.tmp
<Current directory>\eQso.ico
<Current directory>\rIYs.ico
<Current directory>\Qooq.exe
C:\RCX77.tmp
<Current directory>\wEEE.ico
<Current directory>\HYAQ.exe
C:\RCX76.tmp
<Current directory>\ZogU.ico
<Current directory>\hggm.exe
C:\RCX79.tmp
<Current directory>\cYEo.ico
<Current directory>\Bsss.exe
C:\RCX78.tmp
<Current directory>\gMAU.ico
C:\RCX72.tmp
<Current directory>\vQQA.ico
<Current directory>\gMAm.exe
C:\RCX71.tmp
<Current directory>\CQgK.ico
<Current directory>\wQwK.exe
C:\RCX73.tmp
<Current directory>\vIoY.ico
<Current directory>\pUcQ.exe
C:\RCX75.tmp
<Current directory>\xcYS.ico
<Current directory>\DUgQ.exe
C:\RCX74.tmp
C:\RCX45.tmp
C:\RCX16.tmp
<Current directory>\mggW.ico
<Current directory>\Ekgu.exe
C:\RCX15.tmp
<Current directory>\nMUE.ico
<Current directory>\IsYM.exe
C:\RCX17.tmp
<Current directory>\assU.ico
<Current directory>\XgEc.exe
C:\RCX19.tmp
<Current directory>\JUgA.ico
<Current directory>\mkgm.exe
C:\RCX18.tmp
<Current directory>\SMcS.exe
C:\RCX12.tmp
<Current directory>\QAUU.ico
<Current directory>\akQW.exe
C:\RCX11.tmp
<Current directory>\Wcca.ico
<Current directory>\vEME.exe
C:\RCX14.tmp
<Current directory>\cgAI.ico
<Current directory>\loow.exe
C:\RCX13.tmp
<Current directory>\KQUq.ico
<Current directory>\XkUK.exe
<Current directory>\WQEc.exe
C:\RCX1F.tmp
<Current directory>\nkIA.ico
<Current directory>\wIQU.exe
C:\RCX1E.tmp
<Current directory>\WoEE.ico
<Current directory>\bkEm.exe
C:\RCX21.tmp
<Current directory>\DYIY.ico
<Current directory>\koQQ.exe
C:\RCX20.tmp
<Current directory>\lUEY.ico
<Current directory>\vUEA.exe
<Current directory>\CUcm.ico
<Current directory>\Wwcu.exe
C:\RCX1B.tmp
<Current directory>\REsc.ico
<Current directory>\QocK.exe
C:\RCX1A.tmp
<Current directory>\MsgM.ico
<Current directory>\KIsu.exe
C:\RCX1D.tmp
<Current directory>\bQAk.ico
<Current directory>\RQEG.exe
C:\RCX1C.tmp
<Current directory>\iocE.ico
<Current directory>\TQsw.ico
<Current directory>\Poom.ico
<Current directory>\Dkgc.exe
C:\RCX5.tmp
<Current directory>\NsoY.ico
<Current directory>\aAMK.exe
C:\RCX4.tmp
<Current directory>\Vgko.ico
<Current directory>\iYMI.exe
C:\RCX7.tmp
<Current directory>\WIAI.ico
<Current directory>\wAse.exe
C:\RCX6.tmp
<Current directory>\wwwW.ico
%HOMEPATH%\f.inf
<Current directory>\tcsG.ico
<Current directory>\oMQi.exe
%TEMP%\bEMgksUk.bat
%TEMP%\aion.exe
C:\RCX1.tmp
<Current directory>\uYQu.ico
<Current directory>\QwkK.exe
C:\RCX3.tmp
<Current directory>\MwUc.ico
<Current directory>\vEoy.exe
C:\RCX2.tmp
C:\RCXD.tmp
<Current directory>\yMMG.ico
<Current directory>\DEEg.exe
C:\RCXC.tmp
<Current directory>\MYYK.ico
<Current directory>\lkoo.exe
C:\RCXE.tmp
<Current directory>\JIkY.ico
<Current directory>\OkkE.exe
C:\RCX10.tmp
<Current directory>\sYUC.ico
<Current directory>\sswy.exe
C:\RCXF.tmp
<Current directory>\LoAu.exe
C:\RCX9.tmp
<Current directory>\Agog.ico
<Current directory>\VIcs.exe
C:\RCX8.tmp
<Current directory>\bIQu.ico
<Current directory>\pckg.exe
C:\RCXB.tmp
<Current directory>\lgEy.ico
<Current directory>\nwEa.exe
C:\RCXA.tmp
<Current directory>\IEkK.ico
<Current directory>\BYIo.exe
C:\RCX39.tmp
<Current directory>\vskC.ico
<Current directory>\LsMY.exe
C:\RCX38.tmp
<Current directory>\McQw.ico
<Current directory>\wQAs.exe
C:\RCX3A.tmp
<Current directory>\TkQG.ico
<Current directory>\nAgc.exe
C:\RCX3C.tmp
<Current directory>\VwAy.ico
<Current directory>\iAkK.exe
C:\RCX3B.tmp
<Current directory>\VMME.exe
C:\RCX35.tmp
<Current directory>\rsEA.ico
<Current directory>\XIki.exe
C:\RCX34.tmp
<Current directory>\Ykcw.ico
<Current directory>\wcMU.exe
C:\RCX37.tmp
<Current directory>\Koku.ico
<Current directory>\acMK.exe
C:\RCX36.tmp
<Current directory>\PUAa.ico
<Current directory>\zQQI.exe
<Current directory>\LYAg.exe
C:\RCX42.tmp
<Current directory>\nMYk.ico
<Current directory>\OAYq.exe
C:\RCX41.tmp
<Current directory>\jMAU.ico
<Current directory>\nYwY.exe
C:\RCX44.tmp
<Current directory>\OUYM.ico
<Current directory>\RoYy.exe
C:\RCX43.tmp
<Current directory>\gIcE.ico
<Current directory>\skAo.exe
<Current directory>\uMgw.ico
<Current directory>\pkQU.exe
C:\RCX3E.tmp
<Current directory>\sYwE.ico
<Current directory>\dwIe.exe
C:\RCX3D.tmp
<Current directory>\JEgW.ico
<Current directory>\usQy.exe
C:\RCX40.tmp
<Current directory>\moUc.ico
<Current directory>\FoUS.exe
C:\RCX3F.tmp
<Current directory>\zsIu.ico
<Current directory>\Zoos.ico
<Current directory>\lUEk.ico
<Current directory>\Zggi.exe
C:\RCX28.tmp
<Current directory>\jEwA.ico
<Current directory>\usIk.exe
C:\RCX27.tmp
<Current directory>\lEMu.ico
<Current directory>\wkIM.exe
C:\RCX2A.tmp
<Current directory>\PgIi.ico
<Current directory>\owwK.exe
C:\RCX29.tmp
<Current directory>\QsYo.ico
C:\RCX23.tmp
<Current directory>\qokY.ico
<Current directory>\wAsa.exe
C:\RCX22.tmp
<Current directory>\wQYs.ico
<Current directory>\EkwE.exe
C:\RCX24.tmp
<Current directory>\nIcS.ico
<Current directory>\sMAG.exe
C:\RCX26.tmp
<Current directory>\AMgm.ico
<Current directory>\hocS.exe
C:\RCX25.tmp
C:\RCX30.tmp
<Current directory>\vAkg.ico
<Current directory>\FAou.exe
C:\RCX2F.tmp
<Current directory>\aokE.ico
<Current directory>\RMII.exe
C:\RCX31.tmp
<Current directory>\NMII.ico
<Current directory>\HskK.exe
C:\RCX33.tmp
<Current directory>\hIAe.ico
<Current directory>\iskE.exe
C:\RCX32.tmp
<Current directory>\xIok.exe
C:\RCX2C.tmp
<Current directory>\WUAE.ico
<Current directory>\UswQ.exe
C:\RCX2B.tmp
<Current directory>\YMYO.ico
<Current directory>\hIsS.exe
C:\RCX2E.tmp
<Current directory>\uEoY.ico
<Current directory>\eEAe.exe
C:\RCX2D.tmp
<Current directory>\DcAc.ico
<Current directory>\LUUW.exe

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe

Deletes the following files:

<Current directory>\xIUE.ico
<Current directory>\icAw.exe
<Current directory>\XUgs.ico
<Current directory>\jgAe.exe
<Current directory>\UgkU.ico
<Current directory>\CYYk.exe
<Current directory>\Pgos.ico
<Current directory>\aUYy.exe
<Current directory>\TAAY.exe
<Current directory>\sEok.exe
<Current directory>\vIsm.ico
<Current directory>\JQUE.exe
<Current directory>\joEU.ico
<Current directory>\GgEy.exe
<Current directory>\icEw.ico
<Current directory>\uUww.exe
<Current directory>\MYgU.ico
<Current directory>\MUsM.exe
<Current directory>\rEII.ico
<Current directory>\GwoS.exe
<Current directory>\qEEA.ico
<Current directory>\vEso.exe
<Current directory>\KcYW.ico
<Current directory>\WYsE.exe
<Current directory>\VIwE.ico
<Current directory>\jokG.ico
<Current directory>\iAIK.ico
<Current directory>\usAI.exe
<Current directory>\Ugoy.ico
<Current directory>\UMYS.exe
<Current directory>\JIEO.ico
<Current directory>\IAAS.exe
<Current directory>\LkYi.ico
<Current directory>\JgAc.exe
<Current directory>\IQgs.ico
<Current directory>\hcwY.exe
<Current directory>\skAY.ico
<Current directory>\EAEk.exe
<Current directory>\sYIg.ico
<Current directory>\DYwK.exe
<Current directory>\ZQUK.ico
<Current directory>\hEgs.exe
<Current directory>\FAwe.ico
<Current directory>\LAwY.ico
<Current directory>\jsQG.ico
<Current directory>\wEgA.exe
<Current directory>\MQsy.ico
<Current directory>\CAIO.exe
<Current directory>\tIgY.ico
<Current directory>\pQkU.exe
<Current directory>\JQko.ico
<Current directory>\twkm.exe
<Current directory>\NQgk.ico
<Current directory>\TUwm.exe
<Current directory>\acki.ico
<Current directory>\gEEe.exe
<Current directory>\mIAE.ico
<Current directory>\bock.exe
<Current directory>\DUIo.ico
<Current directory>\eYse.exe
<Current directory>\Ukgq.exe
<Current directory>\eggQ.exe
<Current directory>\zYkU.ico
<Current directory>\Dksq.exe
<Current directory>\PAwS.ico
<Current directory>\kAQs.exe
<Current directory>\Rggq.ico
<Current directory>\KQAW.exe
<Current directory>\uwQM.ico
<Current directory>\Gkki.exe
<Current directory>\AcUW.ico
<Current directory>\TQIq.exe
<Current directory>\vAwK.ico
<Current directory>\ZIws.exe
<Current directory>\kwAw.ico
<Current directory>\YkQo.exe
<Current directory>\ZIoA.ico
<Current directory>\ZMAm.exe
<Current directory>\iogM.exe
<Current directory>\AscA.exe
<Current directory>\mUos.ico
<Current directory>\kEww.exe
<Current directory>\DkQE.ico
<Current directory>\TMoK.exe
<Current directory>\hEIy.ico
<Current directory>\Qcoq.exe
<Current directory>\owIa.ico
<Current directory>\XkoC.exe
<Current directory>\jEkM.ico
<Current directory>\HkcG.exe
<Current directory>\VYEm.ico
<Current directory>\jQAq.exe
<Current directory>\YgsA.ico
<Current directory>\ooUi.exe
<Current directory>\zYkk.ico
<Current directory>\SYog.ico
<Current directory>\NYIw.ico
<Current directory>\Xskm.exe
<Current directory>\AssK.ico
<Current directory>\ocAo.exe
<Current directory>\pgIm.ico
<Current directory>\wscS.exe
<Current directory>\esQK.ico
<Current directory>\xkAM.exe
<Current directory>\cYEo.ico
<Current directory>\LUAo.exe
<Current directory>\eUMo.ico
<Current directory>\SwQg.exe
<Current directory>\xMkE.ico
<Current directory>\cMou.exe
<Current directory>\dMQk.ico
<Current directory>\gcQI.exe
<Current directory>\Pwwg.ico
<Current directory>\Lwgo.ico
<Current directory>\zgQo.ico
<Current directory>\UcIW.exe
<Current directory>\WccY.ico
<Current directory>\nMYy.exe
<Current directory>\eQso.ico
<Current directory>\cIcQ.exe
<Current directory>\MMwY.ico
<Current directory>\ZoEs.exe
<Current directory>\rIYs.ico
<Current directory>\Bsss.exe
<Current directory>\wEEE.ico
<Current directory>\Qooq.exe
<Current directory>\gMAU.ico
<Current directory>\ekUk.exe
<Current directory>\ZogU.ico
<Current directory>\hggm.exe
<Current directory>\HYAQ.exe
<Current directory>\gMAm.exe
<Current directory>\vQQA.ico
<Current directory>\wQwK.exe
<Current directory>\CQgK.ico
<Current directory>\pUcQ.exe
<Current directory>\vIoY.ico
<Current directory>\DUgQ.exe
<Current directory>\xcYS.ico
<Current directory>\Bosi.exe
<Current directory>\mggW.ico
<Current directory>\mkgm.exe
<Current directory>\nMUE.ico
<Current directory>\Ekgu.exe
<Current directory>\assU.ico
<Current directory>\QocK.exe
<Current directory>\JUgA.ico
<Current directory>\XgEc.exe
<Current directory>\IsYM.exe
<Current directory>\vEME.exe
<Current directory>\QAUU.ico
<Current directory>\SMcS.exe
<Current directory>\Wcca.ico
<Current directory>\loow.exe
<Current directory>\cgAI.ico
<Current directory>\XkUK.exe
<Current directory>\KQUq.ico
<Current directory>\bkEm.exe
<Current directory>\nkIA.ico
<Current directory>\WQEc.exe
<Current directory>\WoEE.ico
<Current directory>\koQQ.exe
<Current directory>\DYIY.ico
<Current directory>\vUEA.exe
<Current directory>\lUEY.ico
<Current directory>\bQAk.ico
<Current directory>\CUcm.ico
<Current directory>\RQEG.exe
<Current directory>\REsc.ico
<Current directory>\Wwcu.exe
<Current directory>\iocE.ico
<Current directory>\wIQU.exe
<Current directory>\MsgM.ico
<Current directory>\KIsu.exe
<Current directory>\TQsw.ico
<Current directory>\wAse.exe
<Current directory>\Vgko.ico
<Current directory>\Dkgc.exe
<Current directory>\Poom.ico
<Current directory>\VIcs.exe
<Current directory>\WIAI.ico
<Current directory>\iYMI.exe
<Current directory>\wwwW.ico
<Current directory>\NsoY.ico
<Current directory>\tcsG.ico
<Current directory>\vEoy.exe
%TEMP%\bEMgksUk.bat
<Current directory>\oMQi.exe
<Current directory>\uYQu.ico
<Current directory>\aAMK.exe
<Current directory>\MwUc.ico
<Current directory>\QwkK.exe
<Current directory>\yMMG.ico
<Current directory>\sswy.exe
<Current directory>\MYYK.ico
<Current directory>\DEEg.exe
<Current directory>\JIkY.ico
<Current directory>\akQW.exe
<Current directory>\sYUC.ico
<Current directory>\OkkE.exe
<Current directory>\lkoo.exe
<Current directory>\pckg.exe
<Current directory>\Agog.ico
<Current directory>\LoAu.exe
<Current directory>\bIQu.ico
<Current directory>\nwEa.exe
<Current directory>\lgEy.ico
<Current directory>\BYIo.exe
<Current directory>\IEkK.ico
<Current directory>\EkwE.exe
<Current directory>\vskC.ico
<Current directory>\iAkK.exe
<Current directory>\McQw.ico
<Current directory>\LsMY.exe
<Current directory>\TkQG.ico
<Current directory>\dwIe.exe
<Current directory>\VwAy.ico
<Current directory>\nAgc.exe
<Current directory>\wQAs.exe
<Current directory>\wcMU.exe
<Current directory>\rsEA.ico
<Current directory>\VMME.exe
<Current directory>\Ykcw.ico
<Current directory>\acMK.exe
<Current directory>\Koku.ico
<Current directory>\zQQI.exe
<Current directory>\PUAa.ico
<Current directory>\nYwY.exe
<Current directory>\nMYk.ico
<Current directory>\LYAg.exe
<Current directory>\jMAU.ico
<Current directory>\RoYy.exe
<Current directory>\OUYM.ico
<Current directory>\skAo.exe
<Current directory>\gIcE.ico
<Current directory>\moUc.ico
<Current directory>\uMgw.ico
<Current directory>\FoUS.exe
<Current directory>\sYwE.ico
<Current directory>\pkQU.exe
<Current directory>\zsIu.ico
<Current directory>\OAYq.exe
<Current directory>\JEgW.ico
<Current directory>\usQy.exe
<Current directory>\Zoos.ico
<Current directory>\owwK.exe
<Current directory>\lEMu.ico
<Current directory>\Zggi.exe
<Current directory>\lUEk.ico
<Current directory>\UswQ.exe
<Current directory>\PgIi.ico
<Current directory>\wkIM.exe
<Current directory>\QsYo.ico
<Current directory>\jEwA.ico
<Current directory>\qokY.ico
<Current directory>\hocS.exe
<Current directory>\wQYs.ico
<Current directory>\wAsa.exe
<Current directory>\nIcS.ico
<Current directory>\usIk.exe
<Current directory>\AMgm.ico
<Current directory>\sMAG.exe
<Current directory>\vAkg.ico
<Current directory>\iskE.exe
<Current directory>\aokE.ico
<Current directory>\FAou.exe
<Current directory>\NMII.ico
<Current directory>\XIki.exe
<Current directory>\hIAe.ico
<Current directory>\HskK.exe
<Current directory>\RMII.exe
<Current directory>\hIsS.exe
<Current directory>\WUAE.ico
<Current directory>\xIok.exe
<Current directory>\YMYO.ico
<Current directory>\eEAe.exe
<Current directory>\uEoY.ico
<Current directory>\LUUW.exe
<Current directory>\DcAc.ico

Moves the following files:

from C:\RCX5D.tmp to <Current directory>\jgAe.exe
from C:\RCX5C.tmp to <Current directory>\TAAY.exe
from C:\RCX5F.tmp to <Current directory>\aUYy.exe
from C:\RCX5E.tmp to <Current directory>\icAw.exe
from C:\RCX59.tmp to <Current directory>\sEok.exe
from C:\RCX58.tmp to <Current directory>\JQUE.exe
from C:\RCX5B.tmp to <Current directory>\GgEy.exe
from C:\RCX5A.tmp to <Current directory>\uUww.exe
from C:\RCX60.tmp to <Current directory>\CYYk.exe
from C:\RCX66.tmp to <Current directory>\MUsM.exe
from C:\RCX65.tmp to <Current directory>\GwoS.exe
from C:\RCX68.tmp to <Current directory>\vEso.exe
from C:\RCX67.tmp to <Current directory>\WYsE.exe
from C:\RCX62.tmp to <Current directory>\usAI.exe
from C:\RCX61.tmp to <Current directory>\UMYS.exe
from C:\RCX64.tmp to <Current directory>\IAAS.exe
from C:\RCX63.tmp to <Current directory>\JgAc.exe
from C:\RCX4C.tmp to <Current directory>\hcwY.exe
from C:\RCX4B.tmp to <Current directory>\EAEk.exe
from C:\RCX4E.tmp to <Current directory>\DYwK.exe
from C:\RCX4D.tmp to <Current directory>\hEgs.exe
from C:\RCX48.tmp to <Current directory>\wEgA.exe
from C:\RCX47.tmp to <Current directory>\CAIO.exe
from C:\RCX4A.tmp to <Current directory>\pQkU.exe
from C:\RCX49.tmp to <Current directory>\twkm.exe
from C:\RCX4F.tmp to <Current directory>\Dksq.exe
from C:\RCX55.tmp to <Current directory>\TUwm.exe
from C:\RCX54.tmp to <Current directory>\gEEe.exe
from C:\RCX57.tmp to <Current directory>\bock.exe
from C:\RCX56.tmp to <Current directory>\eYse.exe
from C:\RCX51.tmp to <Current directory>\KQAW.exe
from C:\RCX50.tmp to <Current directory>\eggQ.exe
from C:\RCX53.tmp to <Current directory>\Ukgq.exe
from C:\RCX52.tmp to <Current directory>\kAQs.exe
from C:\RCX69.tmp to <Current directory>\Gkki.exe
from C:\RCX80.tmp to <Current directory>\ZIws.exe
from C:\RCX7F.tmp to <Current directory>\iogM.exe
from C:\RCX82.tmp to <Current directory>\ZMAm.exe
from C:\RCX81.tmp to <Current directory>\TQIq.exe
from C:\RCX7C.tmp to <Current directory>\AscA.exe
from C:\RCX7B.tmp to <Current directory>\kEww.exe
from C:\RCX7E.tmp to <Current directory>\TMoK.exe
from C:\RCX7D.tmp to <Current directory>\Qcoq.exe
from C:\RCX83.tmp to <Current directory>\YkQo.exe
from C:\RCX89.tmp to <Current directory>\XkoC.exe
from C:\RCX88.tmp to <Current directory>\HkcG.exe
from C:\RCX8B.tmp to <Current directory>\jQAq.exe
from C:\RCX8A.tmp to <Current directory>\ooUi.exe
from C:\RCX85.tmp to <Current directory>\Xskm.exe
from C:\RCX84.tmp to <Current directory>\ocAo.exe
from C:\RCX87.tmp to <Current directory>\wscS.exe
from C:\RCX86.tmp to <Current directory>\xkAM.exe
from C:\RCX6F.tmp to <Current directory>\LUAo.exe
from C:\RCX6E.tmp to <Current directory>\SwQg.exe
from C:\RCX71.tmp to <Current directory>\cMou.exe
from C:\RCX70.tmp to <Current directory>\gcQI.exe
from C:\RCX6B.tmp to <Current directory>\UcIW.exe
from C:\RCX6A.tmp to <Current directory>\nMYy.exe
from C:\RCX6D.tmp to <Current directory>\cIcQ.exe
from C:\RCX6C.tmp to <Current directory>\ZoEs.exe
from C:\RCX72.tmp to <Current directory>\wQwK.exe
from C:\RCX78.tmp to <Current directory>\Bsss.exe
from C:\RCX77.tmp to <Current directory>\Qooq.exe
from C:\RCX7A.tmp to <Current directory>\ekUk.exe
from C:\RCX79.tmp to <Current directory>\hggm.exe
from C:\RCX74.tmp to <Current directory>\DUgQ.exe
from C:\RCX73.tmp to <Current directory>\gMAm.exe
from C:\RCX76.tmp to <Current directory>\HYAQ.exe
from C:\RCX75.tmp to <Current directory>\pUcQ.exe
from C:\RCX46.tmp to <Current directory>\Bosi.exe
from C:\RCX17.tmp to <Current directory>\Ekgu.exe
from C:\RCX16.tmp to <Current directory>\IsYM.exe
from C:\RCX19.tmp to <Current directory>\XgEc.exe
from C:\RCX18.tmp to <Current directory>\mkgm.exe
from C:\RCX13.tmp to <Current directory>\vEME.exe
from C:\RCX12.tmp to <Current directory>\SMcS.exe
from C:\RCX15.tmp to <Current directory>\loow.exe
from C:\RCX14.tmp to <Current directory>\XkUK.exe
from C:\RCX1A.tmp to <Current directory>\QocK.exe
from C:\RCX20.tmp to <Current directory>\bkEm.exe
from C:\RCX1F.tmp to <Current directory>\WQEc.exe
from C:\RCX22.tmp to <Current directory>\koQQ.exe
from C:\RCX21.tmp to <Current directory>\vUEA.exe
from C:\RCX1C.tmp to <Current directory>\RQEG.exe
from C:\RCX1B.tmp to <Current directory>\Wwcu.exe
from C:\RCX1E.tmp to <Current directory>\wIQU.exe
from C:\RCX1D.tmp to <Current directory>\KIsu.exe
from C:\RCX6.tmp to <Current directory>\wAse.exe
from C:\RCX5.tmp to <Current directory>\Dkgc.exe
from C:\RCX8.tmp to <Current directory>\VIcs.exe
from C:\RCX7.tmp to <Current directory>\iYMI.exe
from C:\RCX2.tmp to <Current directory>\vEoy.exe
from C:\RCX1.tmp to <Current directory>\oMQi.exe
from C:\RCX4.tmp to <Current directory>\aAMK.exe
from C:\RCX3.tmp to <Current directory>\QwkK.exe
from C:\RCX9.tmp to <Current directory>\LoAu.exe
from C:\RCXF.tmp to <Current directory>\sswy.exe
from C:\RCXE.tmp to <Current directory>\DEEg.exe
from C:\RCX11.tmp to <Current directory>\akQW.exe
from C:\RCX10.tmp to <Current directory>\OkkE.exe
from C:\RCXB.tmp to <Current directory>\BYIo.exe
from C:\RCXA.tmp to <Current directory>\pckg.exe
from C:\RCXD.tmp to <Current directory>\lkoo.exe
from C:\RCXC.tmp to <Current directory>\nwEa.exe
from C:\RCX23.tmp to <Current directory>\EkwE.exe
from C:\RCX3A.tmp to <Current directory>\LsMY.exe
from C:\RCX39.tmp to <Current directory>\wQAs.exe
from C:\RCX3C.tmp to <Current directory>\nAgc.exe
from C:\RCX3B.tmp to <Current directory>\iAkK.exe
from C:\RCX36.tmp to <Current directory>\wcMU.exe
from C:\RCX35.tmp to <Current directory>\VMME.exe
from C:\RCX38.tmp to <Current directory>\acMK.exe
from C:\RCX37.tmp to <Current directory>\zQQI.exe
from C:\RCX3D.tmp to <Current directory>\dwIe.exe
from C:\RCX43.tmp to <Current directory>\nYwY.exe
from C:\RCX42.tmp to <Current directory>\LYAg.exe
from C:\RCX45.tmp to <Current directory>\RoYy.exe
from C:\RCX44.tmp to <Current directory>\skAo.exe
from C:\RCX3F.tmp to <Current directory>\FoUS.exe
from C:\RCX3E.tmp to <Current directory>\pkQU.exe
from C:\RCX41.tmp to <Current directory>\OAYq.exe
from C:\RCX40.tmp to <Current directory>\usQy.exe
from C:\RCX29.tmp to <Current directory>\owwK.exe
from C:\RCX28.tmp to <Current directory>\Zggi.exe
from C:\RCX2B.tmp to <Current directory>\UswQ.exe
from C:\RCX2A.tmp to <Current directory>\wkIM.exe
from C:\RCX25.tmp to <Current directory>\hocS.exe
from C:\RCX24.tmp to <Current directory>\wAsa.exe
from C:\RCX27.tmp to <Current directory>\usIk.exe
from C:\RCX26.tmp to <Current directory>\sMAG.exe
from C:\RCX2C.tmp to <Current directory>\xIok.exe
from C:\RCX32.tmp to <Current directory>\iskE.exe
from C:\RCX31.tmp to <Current directory>\FAou.exe
from C:\RCX34.tmp to <Current directory>\XIki.exe
from C:\RCX33.tmp to <Current directory>\HskK.exe
from C:\RCX2E.tmp to <Current directory>\LUUW.exe
from C:\RCX2D.tmp to <Current directory>\hIsS.exe
from C:\RCX30.tmp to <Current directory>\RMII.exe
from C:\RCX2F.tmp to <Current directory>\eEAe.exe

Network activity:

Connects to:

'19#.#86.45.170':9999
'74.##5.232.51':80
'20#.#7.164.69':9999
'20#.#19.204.12':9999

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Open'
ClassName: '' WindowName: 'Run'
ClassName: '' WindowName: 'Windows Task Manager'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'Open File'
ClassName: '' WindowName: 'mywMQEoQ'
ClassName: 'Indicator' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней