Trojan.DownLoader10.13897

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28579' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6794' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5070' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32329' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29349' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14280' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4618' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9139' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28410' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13977' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30520' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28175' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7933' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3412' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6795' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28646' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11096' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18349' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14983' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19035' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10462' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15753' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30990' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18583' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31677' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1655' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22166' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8922' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17025' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20944' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16122' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19186' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3981' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10378' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5356' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27457' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2576' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18650' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3262' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15904' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21647' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20877' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2810' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3413' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12354' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16272' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24677' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20709' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27373' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11450' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17494' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20977' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9072' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6845' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13158' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4585' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3363' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20743' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32531' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '47' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10445' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23539' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28746' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4116' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16640' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14196' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3129' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17946' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25833' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32413' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15954' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1186' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20961' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14531' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14581' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24611' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6393' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28361' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15218' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18884' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16055' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5791' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12455' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20190' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23790' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29149' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '349' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16923' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7782' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24193' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5205' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28495' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10946' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13826' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30370' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6812' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23573' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3899' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13543' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20860' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19136' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25783' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19487' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4435' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16507' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12170' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7884' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2827' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9474' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13140' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19184' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10563' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22281' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3178' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12053' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19939' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11316' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17645' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26218' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20358' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8302' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30003' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1788' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30588' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9825' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25448' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1956' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30973' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22233' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14412' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12002' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5202' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8619' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24626' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1085' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25665' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21379' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12003' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '849' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11801' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14179' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28678' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21528' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3613' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26201' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24208' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12571' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15869' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5522' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24091' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20842' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11952' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9273' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22719' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10175' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6241' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27139' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24996' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17813' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4250' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8536' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15887' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11751' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31275' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '332' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23907' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20458' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14446' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28511' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1018' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31643' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5455' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4769' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28947' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5305' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13191' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11198' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19085' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19788' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9055' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32179' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15971' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3848' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32631' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7749' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26162' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1470' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20843' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28729' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26737' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1855' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8333' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20557' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19287' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10829' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13090' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26485' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32764' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3595' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9793' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19872' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9457' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13894' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '884' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3514' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15687' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13694' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7264' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31124' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30504' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26252' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29467' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22652' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20894' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5506' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10864' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21798' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19973' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4351' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6460' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1136' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30153' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1102' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19437' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27859' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2057' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22601' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5991' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2071' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26887' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11048' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15569' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2240' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13224' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24326' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25463' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31508' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22887' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12938' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17526' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9841' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4182' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13408' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17059' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5640' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31057' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25314' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6326' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19270' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1739' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32514' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30907' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7934' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29366' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15586' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29517' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4635' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10763' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6477' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13978' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22250' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8788' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11852' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6996' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5774' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27625' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12203' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10245' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8637' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17210' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27005' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18968' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26469' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14832' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23104' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18818' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31141' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26855' = '<Full path to virus>'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Creates and executes the following:

'C:\lsass.exe' /pid=3976
'C:\lsass.exe' /pid=3208
'C:\lsass.exe' /pid=3244
'C:\lsass.exe' /pid=728
'C:\lsass.exe' /pid=1724
'C:\lsass.exe' /pid=2544
'C:\lsass.exe' exe <Full path to virus>
'C:\lsass.exe' /pid=2884
'C:\lsass.exe' /pid=1712

Modifies file system :

Creates the following files:

C:\lsass.exe

Network activity:

Connects to:

'22#.#9.226.212':3128
'24.#.229.177':3128
'12#.#17.122.170':3128
'20#.#2.16.88':3128
'14.##.187.110':3128
'11#.#7.137.145':3128
'94.##.150.54':3128
'21#.#13.49.88':3128
'21#.#6.47.24':3128
'18#.#6.56.47':3128
'18#.#47.74.19':3128
'81.##.246.105':3128
'18#.#9.122.148':3128
'86.##.16.188':3128
'19#.#7.136.141':3128
'76.##5.78.223':3128
'93.##3.135.32':3128
'79.#77.8.52':3128
'10#.#06.252.239':3128
'11#.#99.38.27':3128
'21#.#38.67.79':3128
'21#.#08.216.5':3128
'88.##1.45.80':3128
'19#.#09.183.173':3128
'86.##7.4.236':3128
'85.##8.129.200':3128
'77.##.22.220':3128
'20#.#84.0.160':3128
'77.##5.38.233':3128
'20#.#84.1.29':3128
'11#.#7.224.47':3128
'22#.#66.144.24':3128
'11#.#00.101.127':3128
'20#.#84.0.110':3128
'41.##3.57.72':3128
'85.##.169.99':3128
'95.##.103.111':3128
'21#.#85.28.31':3128
'20#.#59.217.140':3128
'85.##5.41.173':3128
'12#.#.41.218':3128
'80.##0.197.68':3128
'21#.#01.133.103':3128
'18#.#14.237.47':3128
'21#.#43.167.35':3128
'10#.#82.26.172':3128
'11#.#97.206.79':3128
'20#.#48.45.71':3128
'12#.#58.94.2':3128
'82.##.156.76':3128
'85.##7.247.18':3128
'12#.#02.195.227':3128
'24.##5.96.143':3128
'58.#.137.107':3128
'82.##4.206.8':3128
'14#.#41.3.74':3128
'78.##.248.84':3128
'20#.#84.0.251':3128
'21#.#86.183.4':3128
'80.##.105.251':3128
'19#.#7.174.155':3128
'11#.#4.56.143':3128
'81.##.177.162':3128
'20#.#84.1.107':3128
'21#.#78.231.61':3128
'10#.#06.236.116':3128
'20#.#84.3.217':3128
'87.##5.174.70':3128
'76.##9.201.177':3128
'85.##4.50.145':3128
'20#.#84.1.127':3128
'84.##3.192.210':3128
'81.##3.67.193':3128
'85.##.222.78':3128
'83.##3.182.140':3128
'89.#5.5.227':3128
'17#.#02.38.45':3128
'18#.#27.42.6':3128
'19#.#7.134.76':3128
'18#.#7.75.164':3128
'21#.#62.68.127':3128
'79.##9.130.239':3128
'77.##4.35.124':3128
'21#.#98.142.181':3128
'19#.#11.26.219':3128
'75.##3.44.131':3128
'12#.#20.75.129':6667
'80.##.108.202':6667
'61.##.216.20':6667
'62.##.130.244':6667
'77.#54.51.6':6667
'88.##0.200.14':6667
'64.##3.222.61':6667
'65.##.167.21':6667
'24.#4.6.90':6667
'12#.#02.195.227':6667
'59.##1.147.48':6667
'82.##5.221.102':6667
'59.##2.127.194':6667
'12#.#22.243.185':6667
'localhost':65284
'11#.#4.56.143':6667
'21#.#85.28.31':6667
'58.#.26.208':6667
'20#.#84.0.251':6667
'85.##.169.99':6667
'87.##0.150.113':6667
'22#.23.80.7':6667
'15#.#9.252.43':6667
'78.##.16.143':6667
'20#.#.159.34':6667
'61.##.216.69':6667
'88.##6.79.53':6667
'19#.#10.242.233':6667
'12#.#58.94.2':6667
'61.#7.216.7':6667
'19#.#7.211.76':6667
'20#.#4.74.72':6667
'20#.#84.0.135':6667
'19#.#7.134.76':6667
'20#.#06.208.45':6667
'22#.#5.179.42':6667
'19#.#94.95.66':6667
'20#.#64.211.106':6667
'20#.#00.75.221':6667
'86.##.106.30':6667
'85.##5.95.250':6667
'80.##.105.251':6667
'21#.#11.186.114':6667
'18#.#5.17.157':3128
'82.##9.213.117':3128
'11#.#02.95.25':3128
'77.#1.11.83':3128
'20#.#84.3.32':3128
'77.##5.45.244':3128
'19#.#07.110.169':3128
'21#.#4.81.66':3128
'85.##4.169.5':3128
'95.##.87.131':3128
'13#.#32.68.126':3128
'18#.#8.112.37':3128
'20#.#9.100.103':3128
'85.##5.95.250':3128
'61.##1.226.53':3128
'89.##0.7.178':3128
'89.##.244.228':3128
'19#.#79.42.58':3128
'11#.#40.122.221':3128
'20#.#65.11.102':3128
'12#.#60.39.18':3128
'20#.#1.160.62':3128
'20#.#34.68.250':3128
'10#.#06.246.188':3128
'19#.#49.50.68':3128
'21#.#33.172.127':3128
'78.##.103.57':3128
'24.##1.15.187':3128
'19#.#94.95.66':3128
'21#.#6.112.137':3128
'21#.#3.137.171':3128
'18#.#9.152.87':3128
'20#.#39.69.225':3128
'19#.#8.147.41':3128
'12#.#22.243.185':3128
'77.##5.55.245':3128
'18#.#20.227.88':3128
'20#.#84.1.180':3128
'19#.#20.60.143':3128
'11#.#97.218.182':3128
'12#.#73.229.163':3128
'14.##.189.32':3128
'85.##.168.159':3128
'20#.#84.3.231':3128
'14.##.60.247':3128
'79.##9.24.175':3128
'19#.#10.233.233':3128
'24.##.100.188':3128
'20#.#.86.181':3128
'11#.#42.59.235':3128
'86.##.170.92':3128
'59.##1.147.48':3128
'19#.#51.53.33':3128
'18#.#67.31.182':3128
'15#.#9.252.43':3128
'21#.#38.66.44':3128
'84.##2.179.18':3128
'89.##2.17.33':3128
'10#.#82.137.59':3128
'71.##.24.152':3128
'11#.#06.112.190':3128
'89.##2.211.124':3128
'12#.#3.24.33':3128
'20#.#84.2.124':3128
'21#.#2.242.130':3128
'85.##.185.143':3128
'41.##6.12.78':3128
'21#.#82.69.210':3128
'94.##8.248.60':3128
'20#.#84.0.212':3128
'12#.#43.21.78':3128
'77.##3.84.250':3128
'80.##0.205.51':3128
'41.##3.57.74':3128
'21#.#19.88.253':3128
'81.##.136.152':3128
'20#.#84.5.70':3128
'20#.#4.103.163':3128
'94.##.57.102':3128
'82.##.141.57':3128
'85.#25.95.6':3128
'20#.#84.0.135':3128
'18#.#0.16.10':3128
'81.##6.226.54':3128
'20#.#64.211.106':3128
'66.##3.132.185':3128
'17#.#02.43.234':3128
'18#.#8.31.141':3128
'19#.#62.5.100':3128
'<Private IP address>':80
'87.##0.150.113':3128
'22#.#04.55.44':3128
'98.##.253.11':3128
'92.##0.26.22':3128
'19#.#04.148.80':3128
'20#.#1.137.120':3128
'82.##2.103.247':3128
'88.##6.79.53':3128
'91.##.198.23':3128
'89.##2.194.121':3128
'89.##7.75.85':3128
'20#.#60.161.155':3128
'20#.#58.184.230':3128
'12#.#20.159.253':3128
'24.##7.3.252':3128
'77.##3.91.250':3128
'19#.#10.242.233':3128
'19#.#7.134.179':3128
'19#.#10.228.102':3128
'12#.#20.75.129':3128
'76.##9.47.171':3128
'77.#7.181.2':3128
'20#.#84.2.28':3128
'11#.#54.159.252':3128
'84.##.105.49':3128
'21#.#78.237.182':3128
'89.##7.201.178':3128
'79.##6.139.118':3128
'64.##3.222.61':3128
'62.##.113.154':3128
'50.##.27.234':3128
'21#.#72.240.55':3128
'79.##3.231.232':3128
'18#.#92.77.173':3128
'74.#15.5.41':3128
'21#.#38.78.247':3128
'20#.#48.139.97':3128
'17#.#5.130.127':3128
'11#.#4.56.147':3128
'58.#.26.208':3128
'20#.#4.74.72':3128
'20#.#30.209.145':3128
'89.##2.80.146':3128
'20#.#84.5.137':3128
'20#.#38.207.169':3128
'11#.#97.208.138':3128
'20#.#.92.111':3128
'41.##3.57.76':3128
'18#.#9.114.169':3128
'10#.#82.17.226':3128
'10#.#06.249.198':3128
'71.##.211.214':3128
'20#.#84.2.73':3128
'95.##.215.253':3128
'77.##4.36.249':3128
'99.##7.197.172':3128
'11#.#01.19.234':3128
'24.#4.6.90':3128
'18#.#29.191.92':3128
'95.##5.177.250':3128
'12#.#08.66.123':3128
'20#.184.0.2':3128
'19#.#10.242.35':3128
'17#.#02.12.129':3128
'20#.#84.0.115':3128
'72.##4.185.240':3128
'20#.184.4.3':3128
'20#.#84.1.58':3128
'77.#54.51.6':3128
'67.##.137.125':3128
'77.##4.175.192':3128
'75.##.32.229':3128
'11#.#03.172.121':3128
'88.##7.38.114':3128
'18#.#9.173.58':3128
'89.##3.253.161':3128
'10#.#06.229.103':3128
'10#.#82.127.69':3128
'77.##3.90.184':3128
'20#.#84.3.152':3128
'11#.#46.86.131':3128
'12#.#6.129.71':3128
'20#.#84.0.23':3128
'19#.#5.34.26':3128
'85.##4.50.167':3128
'58.#.144.134':3128
'89.##.58.171':3128
'21#.#98.142.157':3128
'21#.#13.52.200':3128
'81.##0.205.158':3128
'81.##2.79.146':3128
'24.##7.157.146':3128
'86.##.106.30':3128
'24.##.206.135':3128
'87.##5.174.159':3128
'11#.#9.208.41':3128
'84.##6.228.64':3128
'21#.#0.42.64':3128
'10#.#06.251.219':3128
'20#.#67.48.141':3128
'89.##2.61.105':3128
'89.#.65.94':3128
'84.##.52.118':3128
'10#.#82.106.134':3128
'20#.#09.60.66':3128
'89.##2.239.240':3128
'11#.#55.3.189':3128
'92.##4.159.173':3128
'83.##2.81.217':3128
'59.##1.32.181':3128
'78.##.16.143':3128
'20#.#84.1.87':3128
'21#.#13.51.252':3128
'90.##0.157.63':3128
'97.##.186.102':3128
'10#.#82.3.140':3128
'87.##5.201.226':3128
'83.#6.48.46':3128
'85.##7.57.116':3128
'60.#2.97.65':3128
'11#.#04.67.30':3128
'10#.#82.45.140':3128
'74.##.209.166':3128
'75.##2.113.107':3128
'62.##3.174.192':3128

UDP:

DNS ASK 86.###.4.TSOP28hdhttp
DNS ASK 84.126
DNS ASK 19#.##1.26.219.dht
DNS ASK 84.ttp

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial