Trojan.DownLoader12.36070

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,C:\ProgramData\sIAowgok\rSYkcwMw.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rSYkcwMw.exe' = 'C:\ProgramData\sIAowgok\rSYkcwMw.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'GocwIYEU.exe' = '%HOMEPATH%\CaIocokM\GocwIYEU.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\services\yoYkgMRX] 'Start' = '00000002'

Infects the following executable files:

C:\ProgramData\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe
C:\ProgramData\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe
C:\ProgramData\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe
C:\ProgramData\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe
C:\ProgramData\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'C:\ProgramData\ZQIIosos\XiskIEYE.exe'
'C:\ProgramData\sIAowgok\rSYkcwMw.exe'
'%HOMEPATH%\CaIocokM\GocwIYEU.exe'

Executes the following:

'<SYSTEM32>\cscript.exe' /c ""%TEMP%\MmYEocwI.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /c ""%TEMP%\WcIEkwgQ.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\conhost.exe'
'<SYSTEM32>\cscript.exe'
'<SYSTEM32>\reg.exe' /pid=0xf34 /log
'<SYSTEM32>\reg.exe' 0xad0 cscript.exe
'<SYSTEM32>\conhost.exe' /c ""%TEMP%\GsoUgIcM.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' /pid=0x464 /log
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cscript.exe' <LS_APPDATA>\Temp/file.vbs
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\conhost.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\conhost.exe' <LS_APPDATA>\Temp/file.vbs
'<SYSTEM32>\conhost.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\cscript.exe' 0x9cc cscript.exe
'<SYSTEM32>\conhost.exe' /c "<Current directory>\<Virus name>"

Modifies file system :

Creates the following files:

<Current directory>\zuEY.ico
%TEMP%\EGoAsgEA.bat
<Current directory>\sgEA.exe
<Current directory>\mqUs.ico
<Current directory>\TMYm.exe
C:\RCXC0F3.tmp
C:\RCXC4DA.tmp
C:\RCXC690.tmp
<Current directory>\OKAM.ico
<Current directory>\MIgC.exe
<Current directory>\YsIs.ico
<Current directory>\Bkkg.exe
%TEMP%\WcIEkwgQ.bat
C:\RCXB903.tmp
<Current directory>\MmAc.ico
<Current directory>\wcUO.exe
C:\RCXB6A1.tmp
<Current directory>\Nwwc.ico
<Current directory>\QcMy.exe
C:\RCXBB35.tmp
<Current directory>\bkIA.ico
<Current directory>\Qcoo.exe
C:\RCXBF7B.tmp
<Current directory>\GYoo.ico
<Current directory>\bgwC.exe
C:\RCXBEBF.tmp
<Current directory>\LsIk.ico
<Current directory>\GQEg.exe
C:\RCXD334.tmp
<Current directory>\Qysc.ico
<Current directory>\FIUC.exe
C:\RCXD1AD.tmp
<Current directory>\fWkw.ico
<Current directory>\LMUA.ico
<Current directory>\Lcsk.exe
C:\RCXD78A.tmp
<Current directory>\iEgg.exe
C:\RCXD641.tmp
%TEMP%\nqwQcYYY.bat
C:\RCXCAD6.tmp
<Current directory>\yoMY.ico
<Current directory>\CMcY.exe
C:\RCXC920.tmp
<Current directory>\kWko.ico
<Current directory>\bAMA.exe
C:\RCXCC6C.tmp
<Current directory>\wAYw.ico
<Current directory>\zUYM.exe
C:\RCXCFF7.tmp
<Current directory>\gqYo.ico
<Current directory>\cwAW.exe
C:\RCXCE70.tmp
<Current directory>\HksI.exe
C:\RCXA519.tmp
<Current directory>\dgEc.ico
<Current directory>\gQgw.exe
C:\RCXA315.tmp
<Current directory>\nOcU.ico
<Current directory>\YUAY.exe
C:\RCXA76C.tmp
<Current directory>\pGQY.ico
<Current directory>\AEce.exe
C:\RCXA6A0.tmp
<Current directory>\ESMs.ico
<Current directory>\pwIK.exe
%TEMP%\gAIQQcoE.bat
<Current directory>\igIQ.exe
C:\RCX9E51.tmp
<Current directory>\FYUI.exe
C:\RCX9C6D.tmp
<Current directory>\FOUc.ico
<Current directory>\QIAM.ico
<Current directory>\AwsU.exe
C:\RCXA19E.tmp
<Current directory>\pkAo.ico
<Current directory>\HYAy.exe
C:\RCX9FF8.tmp
<Current directory>\LqUk.ico
C:\RCXB122.tmp
<Current directory>\dUUs.ico
%TEMP%\MmYEocwI.bat
<Current directory>\hIIo.ico
%TEMP%\QOIUAQoI.bat
<Current directory>\sEUG.exe
<Current directory>\BIgO.exe
C:\RCXB4AD.tmp
<Current directory>\uGoo.ico
<Current directory>\WMwe.exe
C:\RCXB24C.tmp
<Current directory>\bSEA.ico
<Current directory>\xEsM.exe
C:\RCXAA5B.tmp
<Current directory>\dQwg.ico
<Current directory>\HQAY.exe
C:\RCXA8F3.tmp
<Current directory>\Pgoo.ico
<Current directory>\Iksa.exe
C:\RCXABB3.tmp
<Current directory>\NKAE.ico
<Current directory>\GEMU.exe
C:\RCXAF7C.tmp
<Current directory>\LuMI.ico
<Current directory>\Wsww.exe
C:\RCXAD49.tmp
%TEMP%\GsoUgIcM.bat
<Current directory>\iqQE.ico
%TEMP%\WwwEIQgI.bat
<Current directory>\XcAM.exe
<Current directory>\tyEE.ico
<Current directory>\xscs.exe
C:\RCXFA6B.tmp
C:\RCXFC12.tmp
C:\RCXFE73.tmp
<Current directory>\aqoU.ico
<Current directory>\QwkM.exe
%TEMP%\TmkcEocw.bat
<Current directory>\TmcE.ico
<Current directory>\lcUI.exe
C:\RCXF578.tmp
<Current directory>\EeEM.ico
<Current directory>\OgsU.exe
C:\RCXF393.tmp
<Current directory>\ZEgw.ico
<Current directory>\vAsC.exe
C:\RCXF663.tmp
<Current directory>\TyAM.ico
<Current directory>\BMMg.exe
C:\RCXF952.tmp
<Current directory>\viQc.ico
<Current directory>\mkcu.exe
C:\RCXF78C.tmp
<Current directory>\OUog.ico
<Current directory>\FgsI.exe
C:\RCXAE8.tmp
<Current directory>\ZYsc.ico
<Current directory>\mgQA.exe
C:\RCX8F4.tmp
<Current directory>\Scks.ico
%TEMP%\kikgkwkA.bat
<Current directory>\nUMS.exe
C:\RCXF8C.tmp
<Current directory>\nkEg.exe
C:\RCXE24.tmp
<Current directory>\OkIA.ico
C:\RCX1DF.tmp
<Current directory>\JuEM.ico
<Current directory>\Ogwg.exe
C:\RCXFFDB.tmp
<Current directory>\oYAw.ico
<Current directory>\gQIg.exe
C:\RCX366.tmp
<Current directory>\piwI.ico
<Current directory>\CkAW.exe
C:\RCX75E.tmp
<Current directory>\IKsw.ico
<Current directory>\kcIq.exe
C:\RCX4CD.tmp
<Current directory>\cccS.exe
C:\RCXE1AD.tmp
<Current directory>\FGso.ico
<Current directory>\ykEQ.exe
C:\RCXE074.tmp
<Current directory>\aAAc.ico
<Current directory>\AkAo.exe
C:\RCXE5A5.tmp
<Current directory>\Waws.ico
<Current directory>\YAwi.exe
C:\RCXE40F.tmp
<Current directory>\ZucM.ico
<Current directory>\dEQm.exe
<Current directory>\GWYU.ico
<Current directory>\acEC.exe
C:\RCXDBDF.tmp
<Current directory>\fwks.ico
<Current directory>\iQsw.exe
C:\RCXD9FB.tmp
<Current directory>\VuoU.ico
<Current directory>\TUEa.exe
C:\RCXDECE.tmp
<Current directory>\xKoU.ico
<Current directory>\QAQy.exe
C:\RCXDD47.tmp
<Current directory>\QcsY.ico
<Current directory>\CgMG.exe
C:\RCXEF2D.tmp
<Current directory>\bEgQ.ico
<Current directory>\iEgm.exe
C:\RCXEDC5.tmp
<Current directory>\OgAc.ico
<Current directory>\YgMo.exe
C:\RCXF1FD.tmp
<Current directory>\UgUs.ico
<Current directory>\IcIw.exe
C:\RCXF102.tmp
<Current directory>\dOYA.ico
<Current directory>\wgsc.exe
C:\RCXE911.tmp
%TEMP%\JWwskcww.bat
<Current directory>\Tsog.ico
C:\RCXE75B.tmp
<Current directory>\Ukwg.ico
<Current directory>\rwwK.exe
<Current directory>\NwIk.exe
<Current directory>\KAUG.exe
C:\RCXEBA2.tmp
<Current directory>\dUIQ.ico
%TEMP%\kUUkEkEc.bat
C:\RCXEA79.tmp
<Current directory>\fyUE.ico
%TEMP%\aswscEQA.bat
<Current directory>\vcsK.exe
C:\RCX4913.tmp
<Current directory>\LUUM.ico
<Current directory>\rsgU.exe
C:\RCX476C.tmp
<Current directory>\PkUY.ico
<Current directory>\jMUw.exe
C:\RCX4B85.tmp
<Current directory>\IiQw.ico
<Current directory>\SAUO.exe
C:\RCX49B0.tmp
<Current directory>\oOEs.ico
<Current directory>\jYgE.exe
<Current directory>\WqcU.ico
<Current directory>\ocUC.exe
C:\RCX3FDB.tmp
<Current directory>\Uocu.exe
C:\RCX3DB8.tmp
%TEMP%\hUEEMQEo.bat
<Current directory>\Iigo.ico
<Current directory>\YUAo.exe
C:\RCX447F.tmp
<Current directory>\MAsY.ico
<Current directory>\QUsu.exe
C:\RCX4172.tmp
<Current directory>\QYkY.ico
<Current directory>\DcwU.exe
C:\RCX5838.tmp
<Current directory>\TkIM.ico
<Current directory>\iEQc.exe
C:\RCX5605.tmp
<Current directory>\wAUY.ico
<Current directory>\DIAi.exe
C:\RCX5D0A.tmp
<Current directory>\UIAU.ico
<Current directory>\Nccy.exe
C:\RCX5990.tmp
<Current directory>\tCAo.ico
<Current directory>\uIAo.exe
C:\RCX50D4.tmp
<Current directory>\woUE.ico
<Current directory>\NYUg.exe
C:\RCX4CFC.tmp
<Current directory>\kwsk.ico
<Current directory>\QcQO.exe
%TEMP%\IqUgUgkA.bat
%TEMP%\pIAUsoYU.bat
C:\RCX54AD.tmp
<Current directory>\ccAc.ico
C:\RCX5326.tmp
<Current directory>\oKMw.ico
<Current directory>\vAQA.exe
<Current directory>\rMsm.exe
C:\RCX2878.tmp
<Current directory>\KScI.ico
<Current directory>\xIUe.exe
C:\RCX1E3A.tmp
<Current directory>\AWkc.ico
<Current directory>\dkAI.exe
<Current directory>\nUMm.exe
C:\RCX2C32.tmp
%TEMP%\VassoIQE.bat
C:\RCX29FF.tmp
%TEMP%\QWYwYoIc.bat
<Current directory>\JWUg.ico
<SYSTEM32>\config\systemprofile\CaIocokM\GocwIYEU
%TEMP%\cqYAUgEE.bat
<Current directory>\<Virus name>
%HOMEPATH%\CaIocokM\GocwIYEU
C:\ProgramData\sIAowgok\rSYkcwMw
C:\ProgramData\ZQIIosos\XiskIEYE.exe
C:\ProgramData\kaog.txt
<Current directory>\tEou.exe
C:\RCX1988.tmp
<Current directory>\mWkc.ico
%TEMP%\xaEkwoEo.bat
%TEMP%\file.vbs
<Current directory>\LuIM.ico
<Current directory>\ZQQa.exe
C:\RCX3933.tmp
<Current directory>\dqwE.ico
<Current directory>\DYkO.exe
C:\RCX3599.tmp
<Current directory>\OYAY.ico
<Current directory>\QMgM.exe
C:\RCX3C12.tmp
<Current directory>\xOAQ.ico
%TEMP%\MQoYswMc.bat
C:\RCX3AD9.tmp
<Current directory>\TSMg.ico
<Current directory>\cMUA.exe
<Current directory>\pmAM.ico
<Current directory>\WMco.exe
C:\RCX325B.tmp
<Current directory>\cgkc.ico
<Current directory>\DMoU.exe
C:\RCX2EA3.tmp
<Current directory>\hecE.ico
<Current directory>\GMAS.exe
C:\RCX3470.tmp
<Current directory>\UAcA.ico
<Current directory>\hUEE.exe
C:\RCX3375.tmp
<Current directory>\uyQw.ico
C:\RCX5E91.tmp
<Current directory>\eyMg.ico
<Current directory>\pIoE.exe
C:\RCX87B9.tmp
<Current directory>\tKEY.ico
<Current directory>\pQkC.exe
C:\RCX86DE.tmp
<Current directory>\QGQo.ico
<Current directory>\eMgE.ico
<Current directory>\hUsO.exe
%TEMP%\LOQwIMkI.bat
%TEMP%\bAIowUsw.bat
<Current directory>\eIMw.exe
C:\RCX8912.tmp
C:\RCX7DE5.tmp
<Current directory>\ZWgQ.ico
<Current directory>\mQQy.exe
C:\RCX7C00.tmp
<Current directory>\geQw.ico
<Current directory>\Pgou.exe
C:\RCX8101.tmp
<Current directory>\SeIk.ico
<Current directory>\zEYu.exe
C:\RCX84EA.tmp
<Current directory>\ayks.ico
<Current directory>\bgQw.exe
C:\RCX841E.tmp
<Current directory>\tWsU.ico
<Current directory>\zwMs.exe
C:\RCX9623.tmp
<Current directory>\ruAA.ico
<Current directory>\kgEo.exe
C:\RCX943E.tmp
<Current directory>\sagE.ico
<Current directory>\hMcy.exe
C:\RCX9A4A.tmp
<Current directory>\AMgY.ico
<Current directory>\DMoE.exe
C:\RCX9894.tmp
<Current directory>\GCcI.ico
C:\RCX8C00.tmp
<Current directory>\rSsI.ico
<Current directory>\BooU.exe
C:\RCX8A5A.tmp
<Current directory>\fEsw.ico
<Current directory>\EAsy.exe
C:\RCX8EEE.tmp
<Current directory>\aWcg.ico
<Current directory>\poYG.exe
C:\RCX92A8.tmp
<Current directory>\EKMU.ico
<Current directory>\kIcS.exe
C:\RCX90D3.tmp
<Current directory>\PMMK.exe
C:\RCX679B.tmp
<Current directory>\QyUA.ico
%TEMP%\gkMUgggk.bat
%TEMP%\wiEMAEgU.bat
<Current directory>\jSIQ.ico
<Current directory>\FUsy.exe
C:\RCX6B45.tmp
<Current directory>\EgsQ.ico
<Current directory>\NYgY.exe
C:\RCX699F.tmp
<Current directory>\nqIM.ico
<Current directory>\UYck.exe
<Current directory>\JEck.ico
<Current directory>\sMsE.exe
C:\RCX6113.tmp
<Current directory>\uoss.ico
<Current directory>\OsAM.exe
C:\RCX6018.tmp
<Current directory>\Gasc.ico
<Current directory>\JgsW.exe
C:\RCX63F2.tmp
<Auxiliary element>
<Current directory>\gwcu.exe
C:\RCX61EE.tmp
<Current directory>\WgMw.ico
%TEMP%\gQAIwoQA.bat
<Current directory>\eyQM.ico
<Current directory>\EkAC.exe
<Current directory>\KyAA.ico
<Current directory>\ZAIW.exe
C:\RCX74AD.tmp
C:\RCX78E3.tmp
C:\RCX7AA8.tmp
<Current directory>\rMAQ.ico
<Current directory>\IIgo.exe
%TEMP%\iogEYkEs.bat
<Current directory>\pOkc.ico
<Current directory>\UMce.exe
C:\RCX7036.tmp
<Current directory>\NsYA.ico
<Current directory>\ekou.exe
C:\RCX6CBC.tmp
<Current directory>\EyIU.ico
<Current directory>\ZccG.exe
C:\RCX7141.tmp
<Current directory>\fGMI.ico
<Current directory>\agYk.exe
C:\RCX73E1.tmp
<Current directory>\smkc.ico
<Current directory>\WIEq.exe
C:\RCX7316.tmp

Deletes the following files:

%TEMP%\EGoAsgEA.bat
<Current directory>\YsIs.ico
<Current directory>\zuEY.ico
<Current directory>\sgEA.exe
<Current directory>\MIgC.exe
<Current directory>\kWko.ico
<Current directory>\Bkkg.exe
<Current directory>\OKAM.ico
<Current directory>\bgwC.exe
<Current directory>\bkIA.ico
<Current directory>\wcUO.exe
<Current directory>\GYoo.ico
<Current directory>\TMYm.exe
%TEMP%\MmYEocwI.bat
<Current directory>\Qcoo.exe
<Current directory>\mqUs.ico
<Current directory>\bAMA.exe
<Current directory>\fWkw.ico
<Current directory>\iEgg.exe
<Current directory>\LsIk.ico
<Current directory>\GQEg.exe
<Current directory>\LMUA.ico
<Current directory>\Lcsk.exe
%TEMP%\WcIEkwgQ.bat
%TEMP%\nqwQcYYY.bat
<Current directory>\gqYo.ico
<Current directory>\cwAW.exe
<Current directory>\yoMY.ico
<Current directory>\CMcY.exe
<Current directory>\Qysc.ico
<Current directory>\FIUC.exe
<Current directory>\wAYw.ico
<Current directory>\zUYM.exe
<Current directory>\MmAc.ico
<Current directory>\ESMs.ico
<Current directory>\pwIK.exe
<Current directory>\dgEc.ico
<Current directory>\YUAY.exe
<Current directory>\Pgoo.ico
<Current directory>\Iksa.exe
<Current directory>\pGQY.ico
<Current directory>\AEce.exe
<Current directory>\LqUk.ico
<Current directory>\AwsU.exe
<Current directory>\QIAM.ico
<Current directory>\HYAy.exe
<Current directory>\nOcU.ico
<Current directory>\HksI.exe
<Current directory>\pkAo.ico
<Current directory>\gQgw.exe
<Current directory>\dQwg.ico
<Current directory>\bSEA.ico
<Current directory>\xEsM.exe
<Current directory>\dUUs.ico
<Current directory>\BIgO.exe
<Current directory>\Nwwc.ico
<Current directory>\QcMy.exe
<Current directory>\uGoo.ico
<Current directory>\WMwe.exe
<Current directory>\Wsww.exe
<Current directory>\NKAE.ico
<Current directory>\HQAY.exe
<Current directory>\LuMI.ico
<Current directory>\hIIo.ico
<Current directory>\sEUG.exe
<Current directory>\GEMU.exe
%TEMP%\QOIUAQoI.bat
<Current directory>\fwks.ico
<Current directory>\xscs.exe
%TEMP%\kUUkEkEc.bat
<Current directory>\BMMg.exe
<Current directory>\tyEE.ico
<Current directory>\XcAM.exe
<Current directory>\TmcE.ico
%TEMP%\WwwEIQgI.bat
<Current directory>\iqQE.ico
<Current directory>\vAsC.exe
<Current directory>\EeEM.ico
<Current directory>\IcIw.exe
<Current directory>\ZEgw.ico
<Current directory>\mkcu.exe
<Current directory>\TyAM.ico
<Current directory>\OgsU.exe
<Current directory>\viQc.ico
<Current directory>\lcUI.exe
<Current directory>\ZYsc.ico
<Current directory>\mgQA.exe
<Current directory>\piwI.ico
<Current directory>\CkAW.exe
<Current directory>\Scks.ico
<Current directory>\nkEg.exe
<Current directory>\OUog.ico
<Current directory>\FgsI.exe
<Current directory>\oYAw.ico
<Current directory>\gQIg.exe
<Current directory>\aqoU.ico
<Current directory>\QwkM.exe
<Current directory>\IKsw.ico
<Current directory>\kcIq.exe
<Current directory>\JuEM.ico
<Current directory>\Ogwg.exe
<Current directory>\UgUs.ico
<Current directory>\cccS.exe
<Current directory>\FGso.ico
<Current directory>\ykEQ.exe
<Current directory>\aAAc.ico
<Current directory>\dEQm.exe
<Current directory>\Waws.ico
<Current directory>\AkAo.exe
<Current directory>\ZucM.ico
<Current directory>\acEC.exe
<Current directory>\VuoU.ico
<Current directory>\iQsw.exe
<Current directory>\GWYU.ico
<Current directory>\TUEa.exe
<Current directory>\xKoU.ico
<Current directory>\QAQy.exe
<Current directory>\QcsY.ico
<Current directory>\YAwi.exe
<Current directory>\OgAc.ico
<Current directory>\CgMG.exe
<Current directory>\dUIQ.ico
<Current directory>\iEgm.exe
<Current directory>\dOYA.ico
<Current directory>\wgsc.exe
<Current directory>\bEgQ.ico
<Current directory>\YgMo.exe
<Current directory>\rwwK.exe
%TEMP%\JWwskcww.bat
%TEMP%\GsoUgIcM.bat
<Current directory>\Ukwg.ico
<Current directory>\fyUE.ico
<Current directory>\KAUG.exe
<Current directory>\Tsog.ico
<Current directory>\NwIk.exe
<Current directory>\igIQ.exe
<Current directory>\jYgE.exe
<Current directory>\IiQw.ico
<Current directory>\jMUw.exe
<Current directory>\oOEs.ico
<Current directory>\QcQO.exe
<Current directory>\woUE.ico
<Current directory>\SAUO.exe
<Current directory>\kwsk.ico
<Current directory>\YUAo.exe
<Current directory>\MAsY.ico
<Current directory>\QUsu.exe
<Current directory>\QYkY.ico
<Current directory>\vcsK.exe
<Current directory>\LUUM.ico
<Current directory>\rsgU.exe
<Current directory>\PkUY.ico
<Current directory>\NYUg.exe
<Current directory>\uIAo.exe
<Current directory>\UIAU.ico
<Current directory>\DIAi.exe
<Current directory>\tCAo.ico
<Current directory>\OsAM.exe
<Current directory>\JEck.ico
<Current directory>\Nccy.exe
<Current directory>\uoss.ico
<Current directory>\vAQA.exe
<Current directory>\ccAc.ico
%TEMP%\IqUgUgkA.bat
<Current directory>\oKMw.ico
<Current directory>\DcwU.exe
<Current directory>\TkIM.ico
<Current directory>\iEQc.exe
<Current directory>\wAUY.ico
<Current directory>\Iigo.ico
<Current directory>\JWUg.ico
<Current directory>\nUMm.exe
<Current directory>\dkAI.exe
%TEMP%\QWYwYoIc.bat
<Current directory>\pmAM.ico
<Current directory>\WMco.exe
<Current directory>\cgkc.ico
<Current directory>\DMoU.exe
<Current directory>\tEou.exe
<Current directory>\mWkc.ico
%TEMP%\cqYAUgEE.bat
<Current directory>\LuIM.ico
<Current directory>\rMsm.exe
<Current directory>\KScI.ico
<Current directory>\xIUe.exe
<Current directory>\AWkc.ico
<Current directory>\hecE.ico
<Current directory>\cMUA.exe
%TEMP%\MQoYswMc.bat
<Current directory>\QMgM.exe
<Current directory>\TSMg.ico
<Current directory>\WqcU.ico
<Current directory>\ocUC.exe
<Current directory>\xOAQ.ico
<Current directory>\Uocu.exe
<Current directory>\GMAS.exe
<Current directory>\UAcA.ico
<Current directory>\hUEE.exe
<Current directory>\uyQw.ico
<Current directory>\ZQQa.exe
<Current directory>\dqwE.ico
<Current directory>\DYkO.exe
<Current directory>\OYAY.ico
<Current directory>\sMsE.exe
%TEMP%\bAIowUsw.bat
<Current directory>\eMgE.ico
<Current directory>\QGQo.ico
<Current directory>\eIMw.exe
<Current directory>\EAsy.exe
<Current directory>\rSsI.ico
<Current directory>\hUsO.exe
<Current directory>\fEsw.ico
<Current directory>\SeIk.ico
<Current directory>\zEYu.exe
<Current directory>\ayks.ico
<Current directory>\bgQw.exe
<Current directory>\eyMg.ico
<Current directory>\pIoE.exe
<Current directory>\tKEY.ico
<Current directory>\pQkC.exe
<Current directory>\BooU.exe
<Current directory>\GCcI.ico
<Current directory>\hMcy.exe
<Current directory>\sagE.ico
<Current directory>\DMoE.exe
%TEMP%\aswscEQA.bat
<Current directory>\FOUc.ico
<Current directory>\AMgY.ico
<Current directory>\FYUI.exe
<Current directory>\aWcg.ico
<Current directory>\poYG.exe
<Current directory>\EKMU.ico
<Current directory>\kIcS.exe
<Current directory>\tWsU.ico
<Current directory>\zwMs.exe
<Current directory>\ruAA.ico
<Current directory>\kgEo.exe
<Current directory>\mQQy.exe
<Current directory>\UYck.exe
<Current directory>\EgsQ.ico
<Current directory>\FUsy.exe
<Current directory>\nqIM.ico
<Current directory>\ZccG.exe
<Current directory>\NsYA.ico
<Current directory>\NYgY.exe
<Current directory>\EyIU.ico
<Current directory>\WgMw.ico
<Current directory>\JgsW.exe
<Current directory>\Gasc.ico
<Current directory>\gwcu.exe
<Current directory>\PMMK.exe
<Current directory>\QyUA.ico
%TEMP%\gkMUgggk.bat
<Current directory>\jSIQ.ico
<Current directory>\ekou.exe
<Current directory>\UMce.exe
<Current directory>\rMAQ.ico
<Current directory>\EkAC.exe
<Current directory>\pOkc.ico
<Current directory>\Pgou.exe
<Current directory>\ZWgQ.ico
<Current directory>\IIgo.exe
<Current directory>\geQw.ico
<Current directory>\fGMI.ico
<Current directory>\agYk.exe
<Current directory>\smkc.ico
<Current directory>\WIEq.exe
%TEMP%\gQAIwoQA.bat
<Current directory>\eyQM.ico
<Current directory>\KyAA.ico
<Current directory>\ZAIW.exe

Moves the following files:

from C:\RCXC4DA.tmp to <Current directory>\sgEA.exe
from C:\RCXC690.tmp to <Current directory>\Bkkg.exe
from C:\RCXC920.tmp to <Current directory>\MIgC.exe
from C:\RCXC0F3.tmp to <Current directory>\TMYm.exe
from C:\RCXBB35.tmp to <Current directory>\wcUO.exe
from C:\RCXBEBF.tmp to <Current directory>\bgwC.exe
from C:\RCXBF7B.tmp to <Current directory>\Qcoo.exe
from C:\RCXCAD6.tmp to <Current directory>\bAMA.exe
from C:\RCXD334.tmp to <Current directory>\GQEg.exe
from C:\RCXD641.tmp to <Current directory>\iEgg.exe
from C:\RCXD78A.tmp to <Current directory>\Lcsk.exe
from C:\RCXD1AD.tmp to <Current directory>\FIUC.exe
from C:\RCXCC6C.tmp to <Current directory>\CMcY.exe
from C:\RCXCE70.tmp to <Current directory>\cwAW.exe
from C:\RCXCFF7.tmp to <Current directory>\zUYM.exe
from C:\RCXB903.tmp to <Current directory>\QcMy.exe
from C:\RCXA6A0.tmp to <Current directory>\YUAY.exe
from C:\RCXA76C.tmp to <Current directory>\pwIK.exe
from C:\RCXA8F3.tmp to <Current directory>\AEce.exe
from C:\RCXA519.tmp to <Current directory>\HksI.exe
from C:\RCX9FF8.tmp to <Current directory>\HYAy.exe
from C:\RCXA19E.tmp to <Current directory>\AwsU.exe
from C:\RCXA315.tmp to <Current directory>\gQgw.exe
from C:\RCXAA5B.tmp to <Current directory>\Iksa.exe
from C:\RCXB24C.tmp to <Current directory>\BIgO.exe
from C:\RCXB4AD.tmp to <Current directory>\xEsM.exe
from C:\RCXB6A1.tmp to <Current directory>\WMwe.exe
from C:\RCXB122.tmp to <Current directory>\sEUG.exe
from C:\RCXABB3.tmp to <Current directory>\HQAY.exe
from C:\RCXAD49.tmp to <Current directory>\Wsww.exe
from C:\RCXAF7C.tmp to <Current directory>\GEMU.exe
from C:\RCXD9FB.tmp to <Current directory>\iQsw.exe
from C:\RCXFA6B.tmp to <Current directory>\xscs.exe
from C:\RCXFC12.tmp to <Current directory>\XcAM.exe
from C:\RCXFE73.tmp to <Current directory>\lcUI.exe
from C:\RCXF952.tmp to <Current directory>\BMMg.exe
from C:\RCXF578.tmp to <Current directory>\vAsC.exe
from C:\RCXF663.tmp to <Current directory>\OgsU.exe
from C:\RCXF78C.tmp to <Current directory>\mkcu.exe
from C:\RCXFFDB.tmp to <Current directory>\QwkM.exe
from C:\RCX8F4.tmp to <Current directory>\mgQA.exe
from C:\RCXAE8.tmp to <Current directory>\FgsI.exe
from C:\RCXE24.tmp to <Current directory>\nkEg.exe
from C:\RCX75E.tmp to <Current directory>\CkAW.exe
from C:\RCX1DF.tmp to <Current directory>\gQIg.exe
from C:\RCX366.tmp to <Current directory>\Ogwg.exe
from C:\RCX4CD.tmp to <Current directory>\kcIq.exe
from C:\RCXF393.tmp to <Current directory>\IcIw.exe
from C:\RCXE1AD.tmp to <Current directory>\cccS.exe
from C:\RCXE40F.tmp to <Current directory>\AkAo.exe
from C:\RCXE5A5.tmp to <Current directory>\dEQm.exe
from C:\RCXE074.tmp to <Current directory>\ykEQ.exe
from C:\RCXDBDF.tmp to <Current directory>\acEC.exe
from C:\RCXDD47.tmp to <Current directory>\QAQy.exe
from C:\RCXDECE.tmp to <Current directory>\TUEa.exe
from C:\RCXE75B.tmp to <Current directory>\YAwi.exe
from C:\RCXEF2D.tmp to <Current directory>\CgMG.exe
from C:\RCXF102.tmp to <Current directory>\YgMo.exe
from C:\RCXF1FD.tmp to <Current directory>\wgsc.exe
from C:\RCXEDC5.tmp to <Current directory>\iEgm.exe
from C:\RCXE911.tmp to <Current directory>\rwwK.exe
from C:\RCXEA79.tmp to <Current directory>\NwIk.exe
from C:\RCXEBA2.tmp to <Current directory>\KAUG.exe
from C:\RCX9E51.tmp to <Current directory>\igIQ.exe
from C:\RCX4B85.tmp to <Current directory>\jYgE.exe
from C:\RCX4CFC.tmp to <Current directory>\SAUO.exe
from C:\RCX50D4.tmp to <Current directory>\QcQO.exe
from C:\RCX49B0.tmp to <Current directory>\jMUw.exe
from C:\RCX447F.tmp to <Current directory>\YUAo.exe
from C:\RCX476C.tmp to <Current directory>\rsgU.exe
from C:\RCX4913.tmp to <Current directory>\vcsK.exe
from C:\RCX5326.tmp to <Current directory>\NYUg.exe
from C:\RCX5D0A.tmp to <Current directory>\uIAo.exe
from C:\RCX5E91.tmp to <Current directory>\Nccy.exe
from C:\RCX6018.tmp to <Current directory>\OsAM.exe
from C:\RCX5990.tmp to <Current directory>\DIAi.exe
from C:\RCX54AD.tmp to <Current directory>\vAQA.exe
from C:\RCX5605.tmp to <Current directory>\iEQc.exe
from C:\RCX5838.tmp to <Current directory>\DcwU.exe
from C:\RCX4172.tmp to <Current directory>\QUsu.exe
from C:\RCX2C32.tmp to <Current directory>\nUMm.exe
from C:\RCX2EA3.tmp to <Current directory>\DMoU.exe
from C:\RCX325B.tmp to <Current directory>\WMco.exe
from C:\RCX29FF.tmp to <Current directory>\dkAI.exe
from C:\RCX1988.tmp to <Current directory>\tEou.exe
from C:\RCX1E3A.tmp to <Current directory>\xIUe.exe
from C:\RCX2878.tmp to <Current directory>\rMsm.exe
from C:\RCX3375.tmp to <Current directory>\hUEE.exe
from C:\RCX3C12.tmp to <Current directory>\cMUA.exe
from C:\RCX3DB8.tmp to <Current directory>\Uocu.exe
from C:\RCX3FDB.tmp to <Current directory>\ocUC.exe
from C:\RCX3AD9.tmp to <Current directory>\QMgM.exe
from C:\RCX3470.tmp to <Current directory>\GMAS.exe
from C:\RCX3599.tmp to <Current directory>\DYkO.exe
from C:\RCX3933.tmp to <Current directory>\ZQQa.exe
from C:\RCX6113.tmp to <Current directory>\sMsE.exe
from C:\RCX8912.tmp to <Current directory>\eIMw.exe
from C:\RCX8A5A.tmp to <Current directory>\hUsO.exe
from C:\RCX8C00.tmp to <Current directory>\EAsy.exe
from C:\RCX87B9.tmp to <Current directory>\pIoE.exe
from C:\RCX841E.tmp to <Current directory>\bgQw.exe
from C:\RCX84EA.tmp to <Current directory>\zEYu.exe
from C:\RCX86DE.tmp to <Current directory>\pQkC.exe
from C:\RCX8EEE.tmp to <Current directory>\BooU.exe
from C:\RCX9894.tmp to <Current directory>\DMoE.exe
from C:\RCX9A4A.tmp to <Current directory>\hMcy.exe
from C:\RCX9C6D.tmp to <Current directory>\FYUI.exe
from C:\RCX9623.tmp to <Current directory>\zwMs.exe
from C:\RCX90D3.tmp to <Current directory>\kIcS.exe
from C:\RCX92A8.tmp to <Current directory>\poYG.exe
from C:\RCX943E.tmp to <Current directory>\kgEo.exe
from C:\RCX8101.tmp to <Current directory>\mQQy.exe
from C:\RCX6B45.tmp to <Current directory>\UYck.exe
from C:\RCX6CBC.tmp to <Current directory>\NYgY.exe
from C:\RCX7036.tmp to <Current directory>\ZccG.exe
from C:\RCX699F.tmp to <Current directory>\FUsy.exe
from C:\RCX61EE.tmp to <Current directory>\gwcu.exe
from C:\RCX63F2.tmp to <Current directory>\JgsW.exe
from C:\RCX679B.tmp to <Current directory>\PMMK.exe
from C:\RCX7141.tmp to <Current directory>\ekou.exe
from C:\RCX7AA8.tmp to <Current directory>\UMce.exe
from C:\RCX7C00.tmp to <Current directory>\IIgo.exe
from C:\RCX7DE5.tmp to <Current directory>\Pgou.exe
from C:\RCX78E3.tmp to <Current directory>\EkAC.exe
from C:\RCX7316.tmp to <Current directory>\WIEq.exe
from C:\RCX73E1.tmp to <Current directory>\agYk.exe
from C:\RCX74AD.tmp to <Current directory>\ZAIW.exe

Deletes itself.

Network activity:

UDP:

DNS ASK dn#.##ftncsi.com
DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'rSYkcwMw.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: 'GocwIYEU.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней