Trojan.DownLoader12.32952

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%TEMP%\Far.exe'
'%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'
'%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

<Current directory>\zcgc.exe
C:\RCX3F.tmp
C:\RCX3E.tmp
<Current directory>\CyAc.ico
<Current directory>\XocQ.ico
<Current directory>\rWUY.ico
<Current directory>\ckwO.exe
<Current directory>\gIQg.exe
C:\RCX40.tmp
<Current directory>\toIS.exe
C:\RCX3C.tmp
C:\RCX3B.tmp
<Current directory>\uwIw.ico
<Current directory>\Igwc.ico
<Current directory>\rGYk.ico
<Current directory>\YcQs.exe
<Current directory>\acgs.exe
C:\RCX3D.tmp
<Current directory>\KIAm.exe
C:\RCX45.tmp
C:\RCX44.tmp
<Current directory>\WKMo.ico
<Current directory>\iYYE.ico
<Current directory>\WekU.ico
<Current directory>\sQcW.exe
<Current directory>\UcAm.exe
C:\RCX46.tmp
<Current directory>\ZMwO.exe
C:\RCX42.tmp
C:\RCX41.tmp
<Current directory>\rUAc.ico
<Current directory>\BGQY.ico
<Current directory>\moQs.ico
<Current directory>\vQMm.exe
<Current directory>\CEIg.exe
C:\RCX43.tmp
<Current directory>\uwQy.exe
<Current directory>\FuQc.ico
<Current directory>\lQAU.exe
<Current directory>\sogC.exe
C:\RCX32.tmp
C:\RCX33.tmp
C:\RCX34.tmp
<Current directory>\paQo.ico
<Current directory>\kMwI.ico
<Current directory>\asgw.exe
<Current directory>\XCkg.ico
<Current directory>\lIkI.exe
<Current directory>\mgUq.exe
C:\RCX2F.tmp
C:\RCX30.tmp
C:\RCX31.tmp
<Current directory>\aUkg.ico
<Current directory>\vcsM.ico
<Current directory>\RkIw.exe
<Current directory>\JqoQ.ico
<Current directory>\MkoS.exe
<Current directory>\owIw.exe
C:\RCX38.tmp
C:\RCX39.tmp
C:\RCX3A.tmp
<Current directory>\IwIg.ico
<Current directory>\WEUI.ico
<Current directory>\oUIE.exe
<Current directory>\oOEs.ico
<Current directory>\FMok.exe
<Current directory>\JAIs.exe
C:\RCX35.tmp
C:\RCX36.tmp
C:\RCX37.tmp
<Current directory>\VKkM.ico
<Current directory>\Kews.ico
<Current directory>\EccA.exe
C:\RCX57.tmp
<Current directory>\FUsA.ico
<Current directory>\ISII.ico
<Current directory>\EMgq.exe
<Current directory>\hUks.exe
<Current directory>\UMgG.exe
C:\RCX59.tmp
C:\RCX58.tmp
<Current directory>\FgMA.ico
C:\RCX54.tmp
<Current directory>\PWEU.ico
<Current directory>\TQUI.ico
<Current directory>\MccO.exe
<Current directory>\yIcu.exe
<Current directory>\Wooe.exe
C:\RCX56.tmp
C:\RCX55.tmp
<Current directory>\RCIQ.ico
C:\RCX5D.tmp
<Current directory>\Amcs.ico
<Current directory>\kEoU.ico
<Current directory>\FwIW.exe
<Current directory>\aQIO.exe
<Current directory>\cMsm.exe
C:\RCX5F.tmp
C:\RCX5E.tmp
<Current directory>\kikA.ico
C:\RCX5A.tmp
<Current directory>\QqEc.ico
<Current directory>\scco.ico
<Current directory>\sIog.exe
<Current directory>\eocS.exe
<Current directory>\skYk.exe
C:\RCX5C.tmp
C:\RCX5B.tmp
<Current directory>\ZAsw.ico
C:\RCX53.tmp
<Current directory>\zkYc.exe
C:\RCX4B.tmp
C:\RCX4A.tmp
<Current directory>\WCAo.ico
<Current directory>\pyMY.ico
<Current directory>\hewQ.ico
<Current directory>\yIEg.exe
<Current directory>\JYMw.exe
C:\RCX4C.tmp
<Current directory>\doEC.exe
C:\RCX48.tmp
C:\RCX47.tmp
<Current directory>\xswE.ico
<Current directory>\Zisg.ico
<Current directory>\lsIs.ico
<Current directory>\ZIIO.exe
<Current directory>\hQQM.exe
C:\RCX49.tmp
<Current directory>\XoYs.exe
C:\RCX51.tmp
C:\RCX50.tmp
<Current directory>\iKsk.ico
<Current directory>\YqYc.ico
<Current directory>\KqEw.ico
<Current directory>\iAkM.exe
<Current directory>\pIwC.exe
C:\RCX52.tmp
<Current directory>\tUgo.exe
C:\RCX4E.tmp
C:\RCX4D.tmp
<Current directory>\ykos.ico
<Current directory>\FcoQ.ico
<Current directory>\RMsY.ico
<Current directory>\BQAO.exe
<Current directory>\oAYI.exe
C:\RCX4F.tmp
C:\RCXE.tmp
<Current directory>\NAEg.ico
<Current directory>\Jwss.ico
<Current directory>\QQIa.exe
<Current directory>\KkQA.exe
<Current directory>\kAEy.exe
C:\RCX10.tmp
C:\RCXF.tmp
<Current directory>\NmgY.ico
C:\RCXB.tmp
<Current directory>\mMok.ico
<Current directory>\qKAc.ico
<Current directory>\mYkQ.exe
<Current directory>\pUAw.exe
<Current directory>\gUsM.exe
C:\RCXD.tmp
C:\RCXC.tmp
<Current directory>\YiIE.ico
C:\RCX14.tmp
<Current directory>\imss.ico
<Current directory>\Ckko.ico
<Current directory>\doMi.exe
<Current directory>\lMgQ.exe
<Current directory>\GUES.exe
C:\RCX16.tmp
C:\RCX15.tmp
<Current directory>\UmsQ.ico
C:\RCX11.tmp
<Current directory>\CAQU.ico
<Current directory>\Sscs.ico
<Current directory>\rMAy.exe
<Current directory>\bIEy.exe
<Current directory>\twsk.exe
C:\RCX13.tmp
C:\RCX12.tmp
<Current directory>\HcwE.ico
C:\RCXA.tmp
<Current directory>\MkYY.exe
C:\RCX2.tmp
C:\RCX1.tmp
<Current directory>\SiYQ.ico
<Current directory>\wIog.ico
<Current directory>\CQQE.ico
<Current directory>\cgwe.exe
<Current directory>\ekAu.exe
C:\RCX3.tmp
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%ALLUSERSPROFILE%\casg.txt
%HOMEPATH%\NIMMEwsg\jaQEcQMQ
%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM
C:\Documents and Settings\LocalService\NIMMEwsg\jaQEcQMQ
%TEMP%\Far.exe
<Current directory>\IEoW.exe
<Current directory>\dCEU.ico
%TEMP%\lywAMMcU.bat
<Current directory>\Jgou.exe
C:\RCX8.tmp
C:\RCX7.tmp
<Current directory>\LiUI.ico
<Current directory>\KOUQ.ico
<Current directory>\gesE.ico
<Current directory>\tEwG.exe
<Current directory>\IMQi.exe
C:\RCX9.tmp
<Current directory>\QUkW.exe
C:\RCX5.tmp
C:\RCX4.tmp
<Current directory>\NAAk.ico
<Current directory>\HEMw.ico
<Current directory>\QIIM.ico
<Current directory>\occm.exe
<Current directory>\okAi.exe
C:\RCX6.tmp
<Current directory>\piIo.ico
<Current directory>\zsgs.exe
<Current directory>\BYIY.exe
C:\RCX26.tmp
C:\RCX27.tmp
C:\RCX28.tmp
<Current directory>\XaEw.ico
<Current directory>\FgQI.ico
<Current directory>\dUUO.exe
<Current directory>\RIkY.ico
<Current directory>\RkEk.exe
<Current directory>\VcoU.exe
C:\RCX23.tmp
C:\RCX24.tmp
C:\RCX25.tmp
<Current directory>\HmYA.ico
<Current directory>\PCAg.ico
<Current directory>\ewsw.exe
<Current directory>\KUMk.ico
<Current directory>\fUMM.exe
<Current directory>\tEcm.exe
C:\RCX2C.tmp
C:\RCX2D.tmp
C:\RCX2E.tmp
<Current directory>\mwIQ.ico
<Current directory>\Tasw.ico
<Current directory>\IkYU.exe
<Current directory>\kmog.ico
<Current directory>\uUwG.exe
<Current directory>\lcMg.exe
C:\RCX29.tmp
C:\RCX2A.tmp
C:\RCX2B.tmp
<Current directory>\ViYQ.ico
<Current directory>\fwkk.ico
<Current directory>\Gsoe.exe
<Current directory>\sIgY.ico
C:\RCX1A.tmp
<Current directory>\KWQU.ico
<Current directory>\PYgE.ico
<Current directory>\WIAY.exe
<Current directory>\wUks.exe
<Current directory>\DAcS.exe
C:\RCX1C.tmp
C:\RCX1B.tmp
<Current directory>\UkMM.ico
C:\RCX17.tmp
<Current directory>\IaQI.ico
<Current directory>\pYUI.ico
<Current directory>\vUQo.exe
<Current directory>\EIkU.exe
<Current directory>\ykMM.exe
C:\RCX19.tmp
C:\RCX18.tmp
<Current directory>\Egco.ico
C:\RCX20.tmp
<Current directory>\eucs.ico
<Current directory>\fyko.ico
<Current directory>\UQsm.exe
<Current directory>\cgMu.exe
<Current directory>\SgkI.exe
C:\RCX22.tmp
C:\RCX21.tmp
<Current directory>\JakQ.ico
C:\RCX1D.tmp
<Current directory>\QIIA.ico
<Current directory>\EAsI.ico
<Current directory>\Bscw.exe
<Current directory>\UwcM.exe
<Current directory>\wkIm.exe
C:\RCX1F.tmp
C:\RCX1E.tmp
<Current directory>\ASIE.ico

Deletes the following files:

<Current directory>\CyAc.ico
<Current directory>\zcgc.exe
<Current directory>\gIQg.exe
<Current directory>\ckwO.exe
<Current directory>\XocQ.ico
<Current directory>\rGYk.ico
<Current directory>\uwIw.ico
<Current directory>\toIS.exe
<Current directory>\acgs.exe
<Current directory>\YcQs.exe
<Current directory>\Igwc.ico
<Current directory>\rWUY.ico
<Current directory>\WKMo.ico
<Current directory>\KIAm.exe
<Current directory>\UcAm.exe
<Current directory>\sQcW.exe
<Current directory>\iYYE.ico
<Current directory>\moQs.ico
<Current directory>\rUAc.ico
<Current directory>\ZMwO.exe
<Current directory>\CEIg.exe
<Current directory>\vQMm.exe
<Current directory>\BGQY.ico
<Current directory>\IwIg.ico
<Current directory>\FuQc.ico
<Current directory>\lQAU.exe
<Current directory>\asgw.exe
<Current directory>\JAIs.exe
<Current directory>\kMwI.ico
<Current directory>\aUkg.ico
<Current directory>\XCkg.ico
<Current directory>\lIkI.exe
<Current directory>\RkIw.exe
<Current directory>\sogC.exe
<Current directory>\vcsM.ico
<Current directory>\paQo.ico
<Current directory>\JqoQ.ico
<Current directory>\MkoS.exe
<Current directory>\oUIE.exe
<Current directory>\uwQy.exe
<Current directory>\WEUI.ico
<Current directory>\VKkM.ico
<Current directory>\oOEs.ico
<Current directory>\FMok.exe
<Current directory>\EccA.exe
<Current directory>\owIw.exe
<Current directory>\Kews.ico
<Current directory>\EMgq.exe
<Current directory>\RCIQ.ico
<Current directory>\ISII.ico
<Current directory>\FUsA.ico
<Current directory>\hUks.exe
<Current directory>\Wooe.exe
<Current directory>\MccO.exe
<Current directory>\KqEw.ico
<Current directory>\TQUI.ico
<Current directory>\PWEU.ico
<Current directory>\yIcu.exe
<Current directory>\UMgG.exe
<Current directory>\FwIW.exe
<Current directory>\ZAsw.ico
<Current directory>\kEoU.ico
<Current directory>\Amcs.ico
<Current directory>\aQIO.exe
<Current directory>\skYk.exe
<Current directory>\sIog.exe
<Current directory>\FgMA.ico
<Current directory>\scco.ico
<Current directory>\QqEc.ico
<Current directory>\eocS.exe
<Current directory>\iAkM.exe
<Current directory>\zkYc.exe
<Current directory>\lsIs.ico
<Current directory>\WCAo.ico
<Current directory>\pyMY.ico
<Current directory>\JYMw.exe
<Current directory>\ZIIO.exe
<Current directory>\doEC.exe
<Current directory>\WekU.ico
<Current directory>\xswE.ico
<Current directory>\Zisg.ico
<Current directory>\hQQM.exe
<Current directory>\yIEg.exe
<Current directory>\XoYs.exe
<Current directory>\RMsY.ico
<Current directory>\iKsk.ico
<Current directory>\YqYc.ico
<Current directory>\pIwC.exe
<Current directory>\BQAO.exe
<Current directory>\tUgo.exe
<Current directory>\hewQ.ico
<Current directory>\ykos.ico
<Current directory>\FcoQ.ico
<Current directory>\oAYI.exe
<Current directory>\mwIQ.ico
<Current directory>\kAEy.exe
<Current directory>\NAEg.ico
<Current directory>\NmgY.ico
<Current directory>\Sscs.ico
<Current directory>\rMAy.exe
<Current directory>\KkQA.exe
<Current directory>\gUsM.exe
<Current directory>\mMok.ico
<Current directory>\YiIE.ico
<Current directory>\Jwss.ico
<Current directory>\QQIa.exe
<Current directory>\bIEy.exe
<Current directory>\GUES.exe
<Current directory>\imss.ico
<Current directory>\UmsQ.ico
<Current directory>\pYUI.ico
<Current directory>\vUQo.exe
<Current directory>\lMgQ.exe
<Current directory>\twsk.exe
<Current directory>\CAQU.ico
<Current directory>\HcwE.ico
<Current directory>\Ckko.ico
<Current directory>\doMi.exe
<Current directory>\pUAw.exe
<Current directory>\cgwe.exe
<Current directory>\wIog.ico
<Current directory>\CQQE.ico
<Current directory>\NAAk.ico
<Current directory>\QUkW.exe
<Current directory>\ekAu.exe
<Current directory>\IEoW.exe
%TEMP%\lywAMMcU.bat
<Current directory>\dCEU.ico
<Current directory>\SiYQ.ico
<Current directory>\MkYY.exe
<Current directory>\okAi.exe
<Current directory>\tEwG.exe
<Current directory>\KOUQ.ico
<Current directory>\gesE.ico
<Current directory>\qKAc.ico
<Current directory>\mYkQ.exe
<Current directory>\IMQi.exe
<Current directory>\occm.exe
<Current directory>\HEMw.ico
<Current directory>\QIIM.ico
<Current directory>\LiUI.ico
<Current directory>\Jgou.exe
<Current directory>\piIo.ico
<Current directory>\zsgs.exe
<Current directory>\dUUO.exe
<Current directory>\lcMg.exe
<Current directory>\FgQI.ico
<Current directory>\HmYA.ico
<Current directory>\RIkY.ico
<Current directory>\RkEk.exe
<Current directory>\ewsw.exe
<Current directory>\BYIY.exe
<Current directory>\PCAg.ico
<Current directory>\XaEw.ico
<Current directory>\KUMk.ico
<Current directory>\fUMM.exe
<Current directory>\IkYU.exe
<Current directory>\mgUq.exe
<Current directory>\Tasw.ico
<Current directory>\ViYQ.ico
<Current directory>\kmog.ico
<Current directory>\uUwG.exe
<Current directory>\Gsoe.exe
<Current directory>\tEcm.exe
<Current directory>\fwkk.ico
<Current directory>\sIgY.ico
<Current directory>\KWQU.ico
<Current directory>\wUks.exe
<Current directory>\DAcS.exe
<Current directory>\Bscw.exe
<Current directory>\UkMM.ico
<Current directory>\PYgE.ico
<Current directory>\IaQI.ico
<Current directory>\EIkU.exe
<Current directory>\ykMM.exe
<Current directory>\WIAY.exe
<Current directory>\Egco.ico
<Current directory>\EAsI.ico
<Current directory>\eucs.ico
<Current directory>\cgMu.exe
<Current directory>\SgkI.exe
<Current directory>\VcoU.exe
<Current directory>\JakQ.ico
<Current directory>\fyko.ico
<Current directory>\QIIA.ico
<Current directory>\UwcM.exe
<Current directory>\wkIm.exe
<Current directory>\UQsm.exe
<Current directory>\ASIE.ico

Moves the following files:

from C:\RCX3F.tmp to <Current directory>\zcgc.exe
from C:\RCX40.tmp to <Current directory>\gIQg.exe
from C:\RCX3E.tmp to <Current directory>\YcQs.exe
from C:\RCX3C.tmp to <Current directory>\toIS.exe
from C:\RCX3D.tmp to <Current directory>\acgs.exe
from C:\RCX41.tmp to <Current directory>\ckwO.exe
from C:\RCX45.tmp to <Current directory>\KIAm.exe
from C:\RCX46.tmp to <Current directory>\UcAm.exe
from C:\RCX44.tmp to <Current directory>\vQMm.exe
from C:\RCX42.tmp to <Current directory>\ZMwO.exe
from C:\RCX43.tmp to <Current directory>\CEIg.exe
from C:\RCX3B.tmp to <Current directory>\uwQy.exe
from C:\RCX33.tmp to <Current directory>\lQAU.exe
from C:\RCX34.tmp to <Current directory>\asgw.exe
from C:\RCX32.tmp to <Current directory>\sogC.exe
from C:\RCX30.tmp to <Current directory>\lIkI.exe
from C:\RCX31.tmp to <Current directory>\RkIw.exe
from C:\RCX35.tmp to <Current directory>\JAIs.exe
from C:\RCX39.tmp to <Current directory>\MkoS.exe
from C:\RCX3A.tmp to <Current directory>\oUIE.exe
from C:\RCX38.tmp to <Current directory>\owIw.exe
from C:\RCX36.tmp to <Current directory>\FMok.exe
from C:\RCX37.tmp to <Current directory>\EccA.exe
from C:\RCX47.tmp to <Current directory>\sQcW.exe
from C:\RCX57.tmp to <Current directory>\EMgq.exe
from C:\RCX58.tmp to <Current directory>\hUks.exe
from C:\RCX56.tmp to <Current directory>\Wooe.exe
from C:\RCX54.tmp to <Current directory>\MccO.exe
from C:\RCX55.tmp to <Current directory>\yIcu.exe
from C:\RCX59.tmp to <Current directory>\UMgG.exe
from C:\RCX5D.tmp to <Current directory>\FwIW.exe
from C:\RCX5E.tmp to <Current directory>\aQIO.exe
from C:\RCX5C.tmp to <Current directory>\skYk.exe
from C:\RCX5A.tmp to <Current directory>\sIog.exe
from C:\RCX5B.tmp to <Current directory>\eocS.exe
from C:\RCX53.tmp to <Current directory>\iAkM.exe
from C:\RCX4B.tmp to <Current directory>\zkYc.exe
from C:\RCX4C.tmp to <Current directory>\JYMw.exe
from C:\RCX4A.tmp to <Current directory>\ZIIO.exe
from C:\RCX48.tmp to <Current directory>\doEC.exe
from C:\RCX49.tmp to <Current directory>\hQQM.exe
from C:\RCX4D.tmp to <Current directory>\yIEg.exe
from C:\RCX51.tmp to <Current directory>\XoYs.exe
from C:\RCX52.tmp to <Current directory>\pIwC.exe
from C:\RCX50.tmp to <Current directory>\BQAO.exe
from C:\RCX4E.tmp to <Current directory>\tUgo.exe
from C:\RCX4F.tmp to <Current directory>\oAYI.exe
from C:\RCX10.tmp to <Current directory>\kAEy.exe
from C:\RCX11.tmp to <Current directory>\rMAy.exe
from C:\RCXF.tmp to <Current directory>\KkQA.exe
from C:\RCXD.tmp to <Current directory>\gUsM.exe
from C:\RCXE.tmp to <Current directory>\QQIa.exe
from C:\RCX12.tmp to <Current directory>\bIEy.exe
from C:\RCX16.tmp to <Current directory>\GUES.exe
from C:\RCX17.tmp to <Current directory>\vUQo.exe
from C:\RCX15.tmp to <Current directory>\lMgQ.exe
from C:\RCX13.tmp to <Current directory>\twsk.exe
from C:\RCX14.tmp to <Current directory>\doMi.exe
from C:\RCXC.tmp to <Current directory>\pUAw.exe
from C:\RCX4.tmp to <Current directory>\cgwe.exe
from C:\RCX5.tmp to <Current directory>\QUkW.exe
from C:\RCX3.tmp to <Current directory>\ekAu.exe
from C:\RCX1.tmp to <Current directory>\IEoW.exe
from C:\RCX2.tmp to <Current directory>\MkYY.exe
from C:\RCX6.tmp to <Current directory>\okAi.exe
from C:\RCXA.tmp to <Current directory>\tEwG.exe
from C:\RCXB.tmp to <Current directory>\mYkQ.exe
from C:\RCX9.tmp to <Current directory>\IMQi.exe
from C:\RCX7.tmp to <Current directory>\occm.exe
from C:\RCX8.tmp to <Current directory>\Jgou.exe
from C:\RCX18.tmp to <Current directory>\EIkU.exe
from C:\RCX28.tmp to <Current directory>\dUUO.exe
from C:\RCX29.tmp to <Current directory>\lcMg.exe
from C:\RCX27.tmp to <Current directory>\zsgs.exe
from C:\RCX25.tmp to <Current directory>\ewsw.exe
from C:\RCX26.tmp to <Current directory>\BYIY.exe
from C:\RCX2A.tmp to <Current directory>\uUwG.exe
from C:\RCX2E.tmp to <Current directory>\IkYU.exe
from C:\RCX2F.tmp to <Current directory>\mgUq.exe
from C:\RCX2D.tmp to <Current directory>\fUMM.exe
from C:\RCX2B.tmp to <Current directory>\Gsoe.exe
from C:\RCX2C.tmp to <Current directory>\tEcm.exe
from C:\RCX24.tmp to <Current directory>\RkEk.exe
from C:\RCX1C.tmp to <Current directory>\DAcS.exe
from C:\RCX1D.tmp to <Current directory>\Bscw.exe
from C:\RCX1B.tmp to <Current directory>\wUks.exe
from C:\RCX19.tmp to <Current directory>\ykMM.exe
from C:\RCX1A.tmp to <Current directory>\WIAY.exe
from C:\RCX1E.tmp to <Current directory>\UwcM.exe
from C:\RCX22.tmp to <Current directory>\SgkI.exe
from C:\RCX23.tmp to <Current directory>\VcoU.exe
from C:\RCX21.tmp to <Current directory>\cgMu.exe
from C:\RCX1F.tmp to <Current directory>\wkIm.exe
from C:\RCX20.tmp to <Current directory>\UQsm.exe

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'jaQEcQMQ.exe'
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: 'AcIcUcAM.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней