Trojan.DownLoader11.40064

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%TEMP%\bdsubmit.exe'
'%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
'%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

<Current directory>\YwcM.ico
<Current directory>\wwcG.exe
C:\RCX5D.tmp
<Current directory>\HsoQ.ico
<Current directory>\zEcS.exe
C:\RCX5C.tmp
<Current directory>\EEYO.ico
<Current directory>\kQgA.exe
C:\RCX5F.tmp
<Current directory>\fssC.ico
<Current directory>\bUQu.exe
C:\RCX5E.tmp
<Current directory>\iccu.ico
C:\RCX58.tmp
<Current directory>\NQwK.ico
<Current directory>\UEwc.exe
C:\RCX57.tmp
<Current directory>\TUMo.ico
<Current directory>\LUou.exe
C:\RCX59.tmp
<Current directory>\fUUi.ico
<Current directory>\hgIe.exe
C:\RCX5B.tmp
<Current directory>\howS.ico
<Current directory>\SUEG.exe
C:\RCX5A.tmp
C:\RCX65.tmp
<Current directory>\ZMcy.ico
<Current directory>\Mgoe.exe
C:\RCX64.tmp
<Current directory>\jggK.ico
<Current directory>\Eksw.exe
C:\RCX66.tmp
<Current directory>\FwcG.ico
<Current directory>\sEMO.exe
C:\RCX68.tmp
<Current directory>\rYkA.ico
<Current directory>\rEUe.exe
C:\RCX67.tmp
<Current directory>\JssM.exe
C:\RCX61.tmp
<Current directory>\hsYC.ico
<Current directory>\oMEo.exe
C:\RCX60.tmp
<Current directory>\lgwE.ico
<Current directory>\ucUY.exe
C:\RCX63.tmp
<Current directory>\AEcc.ico
<Current directory>\nkkI.exe
C:\RCX62.tmp
<Current directory>\PcMg.ico
<Current directory>\fsEy.exe
<Current directory>\tMoA.exe
<Current directory>\kMoI.exe
C:\RCX4B.tmp
<Current directory>\rcUg.ico
<Current directory>\wcYq.exe
C:\RCX4A.tmp
<Current directory>\RYMS.ico
<Current directory>\LgoU.exe
C:\RCX4D.tmp
<Current directory>\QEgC.ico
<Current directory>\RksM.exe
C:\RCX4C.tmp
<Current directory>\eYka.ico
<Current directory>\Asoq.exe
<Current directory>\Oksi.ico
<Current directory>\oMUI.exe
C:\RCX47.tmp
<Current directory>\LwsK.ico
<Current directory>\pwAK.exe
C:\RCX46.tmp
<Current directory>\GUIE.ico
<Current directory>\gsIC.exe
C:\RCX49.tmp
<Current directory>\moUM.ico
<Current directory>\bkkY.exe
C:\RCX48.tmp
<Current directory>\sMUq.ico
<Current directory>\JIkc.ico
<Current directory>\eIsG.exe
C:\RCX54.tmp
<Current directory>\DAsy.ico
<Current directory>\tkgo.exe
C:\RCX53.tmp
<Current directory>\XUso.ico
<Current directory>\iUMk.exe
C:\RCX56.tmp
<Current directory>\jAIE.ico
<Current directory>\qMom.exe
C:\RCX55.tmp
<Current directory>\twUo.ico
C:\RCX4F.tmp
<Current directory>\oIYC.ico
<Current directory>\Skom.exe
C:\RCX4E.tmp
<Current directory>\GgoI.ico
<Current directory>\NosM.exe
C:\RCX50.tmp
<Current directory>\SYAa.ico
<Current directory>\usAM.exe
C:\RCX52.tmp
<Current directory>\uYMO.ico
<Current directory>\AAUu.exe
C:\RCX51.tmp
<Current directory>\ocMU.ico
<Current directory>\kUoG.exe
C:\RCX80.tmp
<Current directory>\ScUy.ico
<Current directory>\zgwo.exe
C:\RCX7F.tmp
<Current directory>\JsUw.ico
<Current directory>\sQwc.exe
C:\RCX82.tmp
<Current directory>\aIkw.ico
<Current directory>\ZMoo.exe
C:\RCX81.tmp
<Current directory>\Ysoi.ico
C:\RCX7B.tmp
<Current directory>\kwMC.ico
<Current directory>\ugUm.exe
C:\RCX7A.tmp
<Current directory>\YQMe.ico
<Current directory>\rsQg.exe
C:\RCX7C.tmp
<Current directory>\ewsS.ico
<Current directory>\dggu.exe
C:\RCX7E.tmp
<Current directory>\QUoC.ico
<Current directory>\xAoe.exe
C:\RCX7D.tmp
C:\RCX88.tmp
<Current directory>\MUwW.ico
<Current directory>\AMwe.exe
C:\RCX87.tmp
<Current directory>\dYQW.ico
<Current directory>\iUYW.exe
C:\RCX89.tmp
<Current directory>\zEwc.ico
<Current directory>\PYoe.exe
C:\RCX8B.tmp
<Current directory>\NoYO.ico
<Current directory>\cwoU.exe
C:\RCX8A.tmp
<Current directory>\qscI.exe
C:\RCX84.tmp
<Current directory>\CEoE.ico
<Current directory>\HEIG.exe
C:\RCX83.tmp
<Current directory>\wMYA.ico
<Current directory>\XMkU.exe
C:\RCX86.tmp
<Current directory>\sMUo.ico
<Current directory>\JYwY.exe
C:\RCX85.tmp
<Current directory>\gIkc.ico
<Current directory>\rcQQ.exe
<Current directory>\AIwQ.exe
<Current directory>\sgAg.exe
C:\RCX6E.tmp
<Current directory>\KMUa.ico
<Current directory>\RkwQ.exe
C:\RCX6D.tmp
<Current directory>\eQww.ico
<Current directory>\hMIE.exe
C:\RCX70.tmp
<Current directory>\owsq.ico
<Current directory>\UksS.exe
C:\RCX6F.tmp
<Current directory>\cEse.ico
<Current directory>\TgIE.exe
<Current directory>\HooS.ico
<Current directory>\IgQw.exe
C:\RCX6A.tmp
<Current directory>\YQMY.ico
<Current directory>\BoAe.exe
C:\RCX69.tmp
<Current directory>\mQES.ico
<Current directory>\GUcy.exe
C:\RCX6C.tmp
<Current directory>\DkcK.ico
<Current directory>\JMMk.exe
C:\RCX6B.tmp
<Current directory>\qoos.ico
<Current directory>\wkcM.ico
<Current directory>\nYYK.exe
C:\RCX77.tmp
<Current directory>\pQAc.ico
<Current directory>\qIMi.exe
C:\RCX76.tmp
<Current directory>\yIMg.ico
<Current directory>\ecwg.exe
C:\RCX79.tmp
<Current directory>\hQIQ.ico
<Current directory>\lIMI.exe
C:\RCX78.tmp
<Current directory>\WUYk.ico
C:\RCX72.tmp
<Current directory>\UsAs.ico
<Current directory>\GwcQ.exe
C:\RCX71.tmp
<Current directory>\MIkm.ico
<Current directory>\scoG.exe
C:\RCX73.tmp
<Current directory>\QcMW.ico
<Current directory>\PsMk.exe
C:\RCX75.tmp
<Current directory>\BwkK.ico
<Current directory>\Cscm.exe
C:\RCX74.tmp
C:\RCX45.tmp
C:\RCX16.tmp
<Current directory>\sIQO.ico
<Current directory>\DAsK.exe
C:\RCX15.tmp
<Current directory>\JkkG.ico
<Current directory>\jgUG.exe
C:\RCX17.tmp
<Current directory>\ZQUs.ico
<Current directory>\XQEA.exe
C:\RCX19.tmp
<Current directory>\NEYW.ico
<Current directory>\oQYm.exe
C:\RCX18.tmp
<Current directory>\KYQs.exe
C:\RCX12.tmp
<Current directory>\ZcEE.ico
<Current directory>\tEEK.exe
C:\RCX11.tmp
<Current directory>\MAsk.ico
<Current directory>\gEgY.exe
C:\RCX14.tmp
<Current directory>\xgwc.ico
<Current directory>\gIUM.exe
C:\RCX13.tmp
<Current directory>\MoIo.ico
<Current directory>\ywEQ.exe
<Current directory>\jIAw.exe
C:\RCX1F.tmp
<Current directory>\eUUw.ico
<Current directory>\QwkG.exe
C:\RCX1E.tmp
<Current directory>\CYwO.ico
<Current directory>\SIoe.exe
C:\RCX21.tmp
<Current directory>\YAwO.ico
<Current directory>\GwIa.exe
C:\RCX20.tmp
<Current directory>\Qgck.ico
<Current directory>\iwgu.exe
<Current directory>\bMww.ico
<Current directory>\swou.exe
C:\RCX1B.tmp
<Current directory>\OEoi.ico
<Current directory>\YsEg.exe
C:\RCX1A.tmp
<Current directory>\OIcU.ico
<Current directory>\HcwA.exe
C:\RCX1D.tmp
<Current directory>\iIcu.ico
<Current directory>\ioEQ.exe
C:\RCX1C.tmp
<Current directory>\joYu.ico
<Current directory>\ZgEg.ico
<Current directory>\WAYk.ico
<Current directory>\KEoq.exe
C:\RCX5.tmp
<Current directory>\kEwc.ico
<Current directory>\ScII.exe
C:\RCX4.tmp
<Current directory>\SIIS.ico
<Current directory>\fMoW.exe
C:\RCX7.tmp
<Current directory>\zAIa.ico
<Current directory>\MEUW.exe
C:\RCX6.tmp
<Current directory>\BIEw.ico
%TEMP%\bdsubmit.exe
<Current directory>\WAEI.ico
<Current directory>\JsYe.exe
%HOMEPATH%\f.inf
%TEMP%\eMcoYcMM.bat
C:\RCX1.tmp
<Current directory>\CYQI.ico
<Current directory>\hIUo.exe
C:\RCX3.tmp
<Current directory>\mIks.ico
<Current directory>\fYMA.exe
C:\RCX2.tmp
C:\RCXD.tmp
<Current directory>\uccu.ico
<Current directory>\YwYS.exe
C:\RCXC.tmp
<Current directory>\CIgK.ico
<Current directory>\KgII.exe
C:\RCXE.tmp
<Current directory>\CMki.ico
<Current directory>\TIEg.exe
C:\RCX10.tmp
<Current directory>\jksS.ico
<Current directory>\ocsc.exe
C:\RCXF.tmp
<Current directory>\ZcAc.exe
C:\RCX9.tmp
<Current directory>\ncEk.ico
<Current directory>\LYoi.exe
C:\RCX8.tmp
<Current directory>\gUkm.ico
<Current directory>\rogS.exe
C:\RCXB.tmp
<Current directory>\KMIE.ico
<Current directory>\xQAe.exe
C:\RCXA.tmp
<Current directory>\WsEo.ico
<Current directory>\MgoW.exe
C:\RCX39.tmp
<Current directory>\qQUg.ico
<Current directory>\CwgI.exe
C:\RCX38.tmp
<Current directory>\kgwu.ico
<Current directory>\SEcI.exe
C:\RCX3A.tmp
<Current directory>\vcMu.ico
<Current directory>\MQcE.exe
C:\RCX3C.tmp
<Current directory>\vsAs.ico
<Current directory>\rcsG.exe
C:\RCX3B.tmp
<Current directory>\dYsk.exe
C:\RCX35.tmp
<Current directory>\SAAs.ico
<Current directory>\Iock.exe
C:\RCX34.tmp
<Current directory>\hUwQ.ico
<Current directory>\RQoK.exe
C:\RCX37.tmp
<Current directory>\PQck.ico
<Current directory>\ewAE.exe
C:\RCX36.tmp
<Current directory>\gsII.ico
<Current directory>\QUIu.exe
<Current directory>\vIUq.exe
C:\RCX42.tmp
<Current directory>\PgsA.ico
<Current directory>\aUUy.exe
C:\RCX41.tmp
<Current directory>\YIQQ.ico
<Current directory>\nkoO.exe
C:\RCX44.tmp
<Current directory>\VMgC.ico
<Current directory>\LEUw.exe
C:\RCX43.tmp
<Current directory>\wgAy.ico
<Current directory>\EQsw.exe
<Current directory>\scoS.ico
<Current directory>\IAQE.exe
C:\RCX3E.tmp
<Current directory>\twEs.ico
<Current directory>\IoIu.exe
C:\RCX3D.tmp
<Current directory>\cAIQ.ico
<Current directory>\UIcO.exe
C:\RCX40.tmp
<Current directory>\LskI.ico
<Current directory>\nUMg.exe
C:\RCX3F.tmp
<Current directory>\PQgo.ico
<Current directory>\SMMk.ico
<Current directory>\nwgi.ico
<Current directory>\LgAK.exe
C:\RCX28.tmp
<Current directory>\eIUM.ico
<Current directory>\ossw.exe
C:\RCX27.tmp
<Current directory>\GQQC.ico
<Current directory>\QwEw.exe
C:\RCX2A.tmp
<Current directory>\vscM.ico
<Current directory>\aooe.exe
C:\RCX29.tmp
<Current directory>\sUUO.ico
C:\RCX23.tmp
<Current directory>\lswa.ico
<Current directory>\psES.exe
C:\RCX22.tmp
<Current directory>\hUQI.ico
<Current directory>\TEce.exe
C:\RCX24.tmp
<Current directory>\EwcY.ico
<Current directory>\yAkm.exe
C:\RCX26.tmp
<Current directory>\kUIS.ico
<Current directory>\NMku.exe
C:\RCX25.tmp
C:\RCX30.tmp
<Current directory>\PUcW.ico
<Current directory>\lwQS.exe
C:\RCX2F.tmp
<Current directory>\ZcIe.ico
<Current directory>\gUEe.exe
C:\RCX31.tmp
<Current directory>\JEco.ico
<Current directory>\bIMc.exe
C:\RCX33.tmp
<Current directory>\YYgk.ico
<Current directory>\PYAa.exe
C:\RCX32.tmp
<Current directory>\yQIS.exe
C:\RCX2C.tmp
<Current directory>\UEAO.ico
<Current directory>\xAoW.exe
C:\RCX2B.tmp
<Current directory>\tkAW.ico
<Current directory>\rEAQ.exe
C:\RCX2E.tmp
<Current directory>\kwQw.ico
<Current directory>\fYsI.exe
C:\RCX2D.tmp
<Current directory>\PIgK.ico
<Current directory>\XMYQ.exe

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe

Deletes the following files:

<Current directory>\YwcM.ico
<Current directory>\bUQu.exe
<Current directory>\HsoQ.ico
<Current directory>\wwcG.exe
<Current directory>\iccu.ico
<Current directory>\oMEo.exe
<Current directory>\EEYO.ico
<Current directory>\kQgA.exe
<Current directory>\zEcS.exe
<Current directory>\UEwc.exe
<Current directory>\NQwK.ico
<Current directory>\LUou.exe
<Current directory>\TUMo.ico
<Current directory>\hgIe.exe
<Current directory>\fUUi.ico
<Current directory>\SUEG.exe
<Current directory>\howS.ico
<Current directory>\Mgoe.exe
<Current directory>\ZMcy.ico
<Current directory>\Eksw.exe
<Current directory>\jggK.ico
<Current directory>\sEMO.exe
<Current directory>\FwcG.ico
<Current directory>\rEUe.exe
<Current directory>\rYkA.ico
<Current directory>\AEcc.ico
<Current directory>\lgwE.ico
<Current directory>\ucUY.exe
<Current directory>\fssC.ico
<Current directory>\JssM.exe
<Current directory>\PcMg.ico
<Current directory>\nkkI.exe
<Current directory>\hsYC.ico
<Current directory>\fsEy.exe
<Current directory>\jAIE.ico
<Current directory>\LgoU.exe
<Current directory>\rcUg.ico
<Current directory>\kMoI.exe
<Current directory>\RYMS.ico
<Current directory>\RksM.exe
<Current directory>\QEgC.ico
<Current directory>\Asoq.exe
<Current directory>\eYka.ico
<Current directory>\moUM.ico
<Current directory>\Oksi.ico
<Current directory>\bkkY.exe
<Current directory>\LwsK.ico
<Current directory>\oMUI.exe
<Current directory>\sMUq.ico
<Current directory>\wcYq.exe
<Current directory>\GUIE.ico
<Current directory>\gsIC.exe
<Current directory>\JIkc.ico
<Current directory>\qMom.exe
<Current directory>\DAsy.ico
<Current directory>\eIsG.exe
<Current directory>\twUo.ico
<Current directory>\tMoA.exe
<Current directory>\XUso.ico
<Current directory>\iUMk.exe
<Current directory>\tkgo.exe
<Current directory>\Skom.exe
<Current directory>\oIYC.ico
<Current directory>\NosM.exe
<Current directory>\GgoI.ico
<Current directory>\usAM.exe
<Current directory>\SYAa.ico
<Current directory>\AAUu.exe
<Current directory>\uYMO.ico
<Current directory>\BoAe.exe
<Current directory>\ocMU.ico
<Current directory>\ZMoo.exe
<Current directory>\ScUy.ico
<Current directory>\kUoG.exe
<Current directory>\Ysoi.ico
<Current directory>\HEIG.exe
<Current directory>\JsUw.ico
<Current directory>\sQwc.exe
<Current directory>\zgwo.exe
<Current directory>\ugUm.exe
<Current directory>\kwMC.ico
<Current directory>\rsQg.exe
<Current directory>\YQMe.ico
<Current directory>\dggu.exe
<Current directory>\ewsS.ico
<Current directory>\xAoe.exe
<Current directory>\QUoC.ico
<Current directory>\AMwe.exe
<Current directory>\MUwW.ico
<Current directory>\iUYW.exe
<Current directory>\dYQW.ico
<Current directory>\PYoe.exe
<Current directory>\zEwc.ico
<Current directory>\cwoU.exe
<Current directory>\NoYO.ico
<Current directory>\sMUo.ico
<Current directory>\wMYA.ico
<Current directory>\XMkU.exe
<Current directory>\aIkw.ico
<Current directory>\qscI.exe
<Current directory>\gIkc.ico
<Current directory>\JYwY.exe
<Current directory>\CEoE.ico
<Current directory>\rcQQ.exe
<Current directory>\hQIQ.ico
<Current directory>\hMIE.exe
<Current directory>\KMUa.ico
<Current directory>\sgAg.exe
<Current directory>\eQww.ico
<Current directory>\UksS.exe
<Current directory>\owsq.ico
<Current directory>\TgIE.exe
<Current directory>\cEse.ico
<Current directory>\DkcK.ico
<Current directory>\HooS.ico
<Current directory>\JMMk.exe
<Current directory>\YQMY.ico
<Current directory>\IgQw.exe
<Current directory>\qoos.ico
<Current directory>\RkwQ.exe
<Current directory>\mQES.ico
<Current directory>\GUcy.exe
<Current directory>\wkcM.ico
<Current directory>\lIMI.exe
<Current directory>\pQAc.ico
<Current directory>\nYYK.exe
<Current directory>\WUYk.ico
<Current directory>\AIwQ.exe
<Current directory>\yIMg.ico
<Current directory>\ecwg.exe
<Current directory>\qIMi.exe
<Current directory>\GwcQ.exe
<Current directory>\UsAs.ico
<Current directory>\scoG.exe
<Current directory>\MIkm.ico
<Current directory>\PsMk.exe
<Current directory>\QcMW.ico
<Current directory>\Cscm.exe
<Current directory>\BwkK.ico
<Current directory>\pwAK.exe
<Current directory>\sIQO.ico
<Current directory>\oQYm.exe
<Current directory>\JkkG.ico
<Current directory>\DAsK.exe
<Current directory>\ZQUs.ico
<Current directory>\YsEg.exe
<Current directory>\NEYW.ico
<Current directory>\XQEA.exe
<Current directory>\jgUG.exe
<Current directory>\gEgY.exe
<Current directory>\ZcEE.ico
<Current directory>\KYQs.exe
<Current directory>\MAsk.ico
<Current directory>\gIUM.exe
<Current directory>\xgwc.ico
<Current directory>\ywEQ.exe
<Current directory>\MoIo.ico
<Current directory>\SIoe.exe
<Current directory>\eUUw.ico
<Current directory>\jIAw.exe
<Current directory>\CYwO.ico
<Current directory>\GwIa.exe
<Current directory>\YAwO.ico
<Current directory>\iwgu.exe
<Current directory>\Qgck.ico
<Current directory>\iIcu.ico
<Current directory>\bMww.ico
<Current directory>\ioEQ.exe
<Current directory>\OEoi.ico
<Current directory>\swou.exe
<Current directory>\joYu.ico
<Current directory>\QwkG.exe
<Current directory>\OIcU.ico
<Current directory>\HcwA.exe
<Current directory>\ZgEg.ico
<Current directory>\MEUW.exe
<Current directory>\SIIS.ico
<Current directory>\KEoq.exe
<Current directory>\WAYk.ico
<Current directory>\LYoi.exe
<Current directory>\zAIa.ico
<Current directory>\fMoW.exe
<Current directory>\BIEw.ico
<Current directory>\kEwc.ico
<Current directory>\WAEI.ico
<Current directory>\fYMA.exe
%TEMP%\eMcoYcMM.bat
<Current directory>\JsYe.exe
<Current directory>\CYQI.ico
<Current directory>\ScII.exe
<Current directory>\mIks.ico
<Current directory>\hIUo.exe
<Current directory>\uccu.ico
<Current directory>\ocsc.exe
<Current directory>\CIgK.ico
<Current directory>\YwYS.exe
<Current directory>\CMki.ico
<Current directory>\tEEK.exe
<Current directory>\jksS.ico
<Current directory>\TIEg.exe
<Current directory>\KgII.exe
<Current directory>\rogS.exe
<Current directory>\ncEk.ico
<Current directory>\ZcAc.exe
<Current directory>\gUkm.ico
<Current directory>\xQAe.exe
<Current directory>\KMIE.ico
<Current directory>\MgoW.exe
<Current directory>\WsEo.ico
<Current directory>\TEce.exe
<Current directory>\qQUg.ico
<Current directory>\rcsG.exe
<Current directory>\kgwu.ico
<Current directory>\CwgI.exe
<Current directory>\vcMu.ico
<Current directory>\IoIu.exe
<Current directory>\vsAs.ico
<Current directory>\MQcE.exe
<Current directory>\SEcI.exe
<Current directory>\RQoK.exe
<Current directory>\SAAs.ico
<Current directory>\dYsk.exe
<Current directory>\hUwQ.ico
<Current directory>\ewAE.exe
<Current directory>\PQck.ico
<Current directory>\QUIu.exe
<Current directory>\gsII.ico
<Current directory>\nkoO.exe
<Current directory>\PgsA.ico
<Current directory>\vIUq.exe
<Current directory>\YIQQ.ico
<Current directory>\LEUw.exe
<Current directory>\VMgC.ico
<Current directory>\EQsw.exe
<Current directory>\wgAy.ico
<Current directory>\LskI.ico
<Current directory>\scoS.ico
<Current directory>\nUMg.exe
<Current directory>\twEs.ico
<Current directory>\IAQE.exe
<Current directory>\PQgo.ico
<Current directory>\aUUy.exe
<Current directory>\cAIQ.ico
<Current directory>\UIcO.exe
<Current directory>\SMMk.ico
<Current directory>\aooe.exe
<Current directory>\GQQC.ico
<Current directory>\LgAK.exe
<Current directory>\nwgi.ico
<Current directory>\xAoW.exe
<Current directory>\vscM.ico
<Current directory>\QwEw.exe
<Current directory>\sUUO.ico
<Current directory>\eIUM.ico
<Current directory>\lswa.ico
<Current directory>\NMku.exe
<Current directory>\hUQI.ico
<Current directory>\psES.exe
<Current directory>\EwcY.ico
<Current directory>\ossw.exe
<Current directory>\kUIS.ico
<Current directory>\yAkm.exe
<Current directory>\PUcW.ico
<Current directory>\PYAa.exe
<Current directory>\ZcIe.ico
<Current directory>\lwQS.exe
<Current directory>\JEco.ico
<Current directory>\Iock.exe
<Current directory>\YYgk.ico
<Current directory>\bIMc.exe
<Current directory>\gUEe.exe
<Current directory>\rEAQ.exe
<Current directory>\UEAO.ico
<Current directory>\yQIS.exe
<Current directory>\tkAW.ico
<Current directory>\fYsI.exe
<Current directory>\kwQw.ico
<Current directory>\XMYQ.exe
<Current directory>\PIgK.ico

Moves the following files:

from C:\RCX5D.tmp to <Current directory>\wwcG.exe
from C:\RCX5C.tmp to <Current directory>\zEcS.exe
from C:\RCX5F.tmp to <Current directory>\kQgA.exe
from C:\RCX5E.tmp to <Current directory>\bUQu.exe
from C:\RCX59.tmp to <Current directory>\UEwc.exe
from C:\RCX58.tmp to <Current directory>\LUou.exe
from C:\RCX5B.tmp to <Current directory>\hgIe.exe
from C:\RCX5A.tmp to <Current directory>\SUEG.exe
from C:\RCX60.tmp to <Current directory>\oMEo.exe
from C:\RCX66.tmp to <Current directory>\Mgoe.exe
from C:\RCX65.tmp to <Current directory>\Eksw.exe
from C:\RCX68.tmp to <Current directory>\sEMO.exe
from C:\RCX67.tmp to <Current directory>\rEUe.exe
from C:\RCX62.tmp to <Current directory>\ucUY.exe
from C:\RCX61.tmp to <Current directory>\JssM.exe
from C:\RCX64.tmp to <Current directory>\nkkI.exe
from C:\RCX63.tmp to <Current directory>\fsEy.exe
from C:\RCX4C.tmp to <Current directory>\LgoU.exe
from C:\RCX4B.tmp to <Current directory>\kMoI.exe
from C:\RCX4E.tmp to <Current directory>\RksM.exe
from C:\RCX4D.tmp to <Current directory>\Asoq.exe
from C:\RCX48.tmp to <Current directory>\bkkY.exe
from C:\RCX47.tmp to <Current directory>\oMUI.exe
from C:\RCX4A.tmp to <Current directory>\wcYq.exe
from C:\RCX49.tmp to <Current directory>\gsIC.exe
from C:\RCX4F.tmp to <Current directory>\NosM.exe
from C:\RCX55.tmp to <Current directory>\qMom.exe
from C:\RCX54.tmp to <Current directory>\eIsG.exe
from C:\RCX57.tmp to <Current directory>\tMoA.exe
from C:\RCX56.tmp to <Current directory>\iUMk.exe
from C:\RCX51.tmp to <Current directory>\AAUu.exe
from C:\RCX50.tmp to <Current directory>\Skom.exe
from C:\RCX53.tmp to <Current directory>\tkgo.exe
from C:\RCX52.tmp to <Current directory>\usAM.exe
from C:\RCX69.tmp to <Current directory>\BoAe.exe
from C:\RCX80.tmp to <Current directory>\kUoG.exe
from C:\RCX7F.tmp to <Current directory>\zgwo.exe
from C:\RCX82.tmp to <Current directory>\sQwc.exe
from C:\RCX81.tmp to <Current directory>\ZMoo.exe
from C:\RCX7C.tmp to <Current directory>\ugUm.exe
from C:\RCX7B.tmp to <Current directory>\rsQg.exe
from C:\RCX7E.tmp to <Current directory>\dggu.exe
from C:\RCX7D.tmp to <Current directory>\xAoe.exe
from C:\RCX83.tmp to <Current directory>\HEIG.exe
from C:\RCX89.tmp to <Current directory>\AMwe.exe
from C:\RCX88.tmp to <Current directory>\iUYW.exe
from C:\RCX8B.tmp to <Current directory>\PYoe.exe
from C:\RCX8A.tmp to <Current directory>\cwoU.exe
from C:\RCX85.tmp to <Current directory>\XMkU.exe
from C:\RCX84.tmp to <Current directory>\qscI.exe
from C:\RCX87.tmp to <Current directory>\JYwY.exe
from C:\RCX86.tmp to <Current directory>\rcQQ.exe
from C:\RCX6F.tmp to <Current directory>\hMIE.exe
from C:\RCX6E.tmp to <Current directory>\sgAg.exe
from C:\RCX71.tmp to <Current directory>\UksS.exe
from C:\RCX70.tmp to <Current directory>\TgIE.exe
from C:\RCX6B.tmp to <Current directory>\JMMk.exe
from C:\RCX6A.tmp to <Current directory>\IgQw.exe
from C:\RCX6D.tmp to <Current directory>\RkwQ.exe
from C:\RCX6C.tmp to <Current directory>\GUcy.exe
from C:\RCX72.tmp to <Current directory>\scoG.exe
from C:\RCX78.tmp to <Current directory>\lIMI.exe
from C:\RCX77.tmp to <Current directory>\nYYK.exe
from C:\RCX7A.tmp to <Current directory>\AIwQ.exe
from C:\RCX79.tmp to <Current directory>\ecwg.exe
from C:\RCX74.tmp to <Current directory>\Cscm.exe
from C:\RCX73.tmp to <Current directory>\GwcQ.exe
from C:\RCX76.tmp to <Current directory>\qIMi.exe
from C:\RCX75.tmp to <Current directory>\PsMk.exe
from C:\RCX46.tmp to <Current directory>\pwAK.exe
from C:\RCX17.tmp to <Current directory>\DAsK.exe
from C:\RCX16.tmp to <Current directory>\jgUG.exe
from C:\RCX19.tmp to <Current directory>\XQEA.exe
from C:\RCX18.tmp to <Current directory>\oQYm.exe
from C:\RCX13.tmp to <Current directory>\gEgY.exe
from C:\RCX12.tmp to <Current directory>\KYQs.exe
from C:\RCX15.tmp to <Current directory>\gIUM.exe
from C:\RCX14.tmp to <Current directory>\ywEQ.exe
from C:\RCX1A.tmp to <Current directory>\YsEg.exe
from C:\RCX20.tmp to <Current directory>\SIoe.exe
from C:\RCX1F.tmp to <Current directory>\jIAw.exe
from C:\RCX22.tmp to <Current directory>\GwIa.exe
from C:\RCX21.tmp to <Current directory>\iwgu.exe
from C:\RCX1C.tmp to <Current directory>\ioEQ.exe
from C:\RCX1B.tmp to <Current directory>\swou.exe
from C:\RCX1E.tmp to <Current directory>\QwkG.exe
from C:\RCX1D.tmp to <Current directory>\HcwA.exe
from C:\RCX6.tmp to <Current directory>\MEUW.exe
from C:\RCX5.tmp to <Current directory>\KEoq.exe
from C:\RCX8.tmp to <Current directory>\LYoi.exe
from C:\RCX7.tmp to <Current directory>\fMoW.exe
from C:\RCX2.tmp to <Current directory>\fYMA.exe
from C:\RCX1.tmp to <Current directory>\JsYe.exe
from C:\RCX4.tmp to <Current directory>\ScII.exe
from C:\RCX3.tmp to <Current directory>\hIUo.exe
from C:\RCX9.tmp to <Current directory>\ZcAc.exe
from C:\RCXF.tmp to <Current directory>\ocsc.exe
from C:\RCXE.tmp to <Current directory>\YwYS.exe
from C:\RCX11.tmp to <Current directory>\tEEK.exe
from C:\RCX10.tmp to <Current directory>\TIEg.exe
from C:\RCXB.tmp to <Current directory>\MgoW.exe
from C:\RCXA.tmp to <Current directory>\rogS.exe
from C:\RCXD.tmp to <Current directory>\KgII.exe
from C:\RCXC.tmp to <Current directory>\xQAe.exe
from C:\RCX23.tmp to <Current directory>\TEce.exe
from C:\RCX3A.tmp to <Current directory>\CwgI.exe
from C:\RCX39.tmp to <Current directory>\SEcI.exe
from C:\RCX3C.tmp to <Current directory>\MQcE.exe
from C:\RCX3B.tmp to <Current directory>\rcsG.exe
from C:\RCX36.tmp to <Current directory>\RQoK.exe
from C:\RCX35.tmp to <Current directory>\dYsk.exe
from C:\RCX38.tmp to <Current directory>\ewAE.exe
from C:\RCX37.tmp to <Current directory>\QUIu.exe
from C:\RCX3D.tmp to <Current directory>\IoIu.exe
from C:\RCX43.tmp to <Current directory>\nkoO.exe
from C:\RCX42.tmp to <Current directory>\vIUq.exe
from C:\RCX45.tmp to <Current directory>\LEUw.exe
from C:\RCX44.tmp to <Current directory>\EQsw.exe
from C:\RCX3F.tmp to <Current directory>\nUMg.exe
from C:\RCX3E.tmp to <Current directory>\IAQE.exe
from C:\RCX41.tmp to <Current directory>\aUUy.exe
from C:\RCX40.tmp to <Current directory>\UIcO.exe
from C:\RCX29.tmp to <Current directory>\aooe.exe
from C:\RCX28.tmp to <Current directory>\LgAK.exe
from C:\RCX2B.tmp to <Current directory>\xAoW.exe
from C:\RCX2A.tmp to <Current directory>\QwEw.exe
from C:\RCX25.tmp to <Current directory>\NMku.exe
from C:\RCX24.tmp to <Current directory>\psES.exe
from C:\RCX27.tmp to <Current directory>\ossw.exe
from C:\RCX26.tmp to <Current directory>\yAkm.exe
from C:\RCX2C.tmp to <Current directory>\yQIS.exe
from C:\RCX32.tmp to <Current directory>\PYAa.exe
from C:\RCX31.tmp to <Current directory>\lwQS.exe
from C:\RCX34.tmp to <Current directory>\Iock.exe
from C:\RCX33.tmp to <Current directory>\bIMc.exe
from C:\RCX2E.tmp to <Current directory>\XMYQ.exe
from C:\RCX2D.tmp to <Current directory>\rEAQ.exe
from C:\RCX30.tmp to <Current directory>\gUEe.exe
from C:\RCX2F.tmp to <Current directory>\fYsI.exe

Network activity:

Connects to:

'19#.#86.45.170':9999
'74.##5.232.51':80
'20#.#7.164.69':9999
'20#.#19.204.12':9999

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Open'
ClassName: '' WindowName: 'Run'
ClassName: '' WindowName: 'Windows Task Manager'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'Open File'
ClassName: '' WindowName: 'mywMQEoQ'
ClassName: 'Indicator' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней