Trojan.DownLoader11.40062

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%TEMP%\vcredist_x86.exe'
'%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
'%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

<Current directory>\HkwA.ico
<Current directory>\XkIU.exe
C:\RCX5C.tmp
<Current directory>\GIkA.ico
<Current directory>\JgAk.exe
C:\RCX5B.tmp
<Current directory>\uwcO.ico
<Current directory>\PkAi.exe
C:\RCX5E.tmp
<Current directory>\pYoC.ico
<Current directory>\zQMG.exe
C:\RCX5D.tmp
<Current directory>\HUAw.ico
C:\RCX57.tmp
<Current directory>\qYUq.ico
<Current directory>\bowm.exe
C:\RCX56.tmp
<Current directory>\WYMW.ico
<Current directory>\DUIc.exe
C:\RCX58.tmp
<Current directory>\OsYs.ico
<Current directory>\Vscm.exe
C:\RCX5A.tmp
<Current directory>\PIAG.ico
<Current directory>\WAoM.exe
C:\RCX59.tmp
<Current directory>\ywwW.exe
<Current directory>\gMoa.ico
<Current directory>\skoo.exe
C:\RCX65.tmp
<Current directory>\iIku.ico
<Current directory>\Fkwu.exe
C:\RCX64.tmp
<Current directory>\UswW.ico
<Current directory>\tcoW.exe
C:\RCX67.tmp
<Current directory>\iEEu.ico
<Current directory>\zwgA.exe
C:\RCX66.tmp
<Current directory>\WYIe.ico
C:\RCX60.tmp
<Current directory>\GAIy.ico
<Current directory>\wsYS.exe
C:\RCX5F.tmp
<Current directory>\xkQu.ico
<Current directory>\MsUG.exe
C:\RCX61.tmp
<Current directory>\cYIw.ico
<Current directory>\VwMk.exe
C:\RCX63.tmp
<Current directory>\KAAK.ico
<Current directory>\loAw.exe
C:\RCX62.tmp
<Current directory>\Hwou.exe
<Current directory>\XAAK.ico
<Current directory>\YgAA.exe
C:\RCX4A.tmp
<Current directory>\uwAi.ico
<Current directory>\ZIsc.exe
C:\RCX49.tmp
<Current directory>\boAi.ico
<Current directory>\XgMG.exe
C:\RCX4C.tmp
<Current directory>\Qkcu.ico
<Current directory>\oQgG.exe
C:\RCX4B.tmp
<Current directory>\psky.ico
C:\RCX45.tmp
<Current directory>\tMYc.ico
<Current directory>\UAss.exe
C:\RCX44.tmp
<Current directory>\OgMy.ico
<Current directory>\QkEC.exe
C:\RCX46.tmp
<Current directory>\ooku.ico
<Current directory>\SwkI.exe
C:\RCX48.tmp
<Current directory>\AssM.ico
<Current directory>\aUAk.exe
C:\RCX47.tmp
<Current directory>\KsMC.exe
<Current directory>\aIwq.ico
<Current directory>\VwIg.exe
C:\RCX53.tmp
<Current directory>\sEEM.ico
<Current directory>\ZIEm.exe
C:\RCX52.tmp
<Current directory>\IMcg.ico
<Current directory>\pcEC.exe
C:\RCX55.tmp
<Current directory>\vQgm.ico
<Current directory>\IcEs.exe
C:\RCX54.tmp
<Current directory>\oAYk.ico
C:\RCX4E.tmp
<Current directory>\WIYC.ico
<Current directory>\oowi.exe
C:\RCX4D.tmp
<Current directory>\zckw.ico
<Current directory>\eUYM.exe
C:\RCX4F.tmp
<Current directory>\vQge.ico
<Current directory>\dUEI.exe
C:\RCX51.tmp
<Current directory>\Xowq.ico
<Current directory>\NAEo.exe
C:\RCX50.tmp
C:\RCX7F.tmp
<Current directory>\dEkw.ico
<Current directory>\QAkC.exe
C:\RCX7E.tmp
<Current directory>\kkIg.ico
<Current directory>\EYQs.exe
C:\RCX80.tmp
<Current directory>\sYMs.ico
<Current directory>\Asgi.exe
C:\RCX82.tmp
<Current directory>\Pkku.ico
<Current directory>\sggA.exe
C:\RCX81.tmp
<Current directory>\zsQC.exe
C:\RCX7B.tmp
<Current directory>\dsga.ico
<Current directory>\jsoy.exe
C:\RCX7A.tmp
<Current directory>\LAky.ico
<Current directory>\asUM.exe
C:\RCX7D.tmp
<Current directory>\nwYu.ico
<Current directory>\Dcgg.exe
C:\RCX7C.tmp
<Current directory>\sQUM.ico
<Current directory>\cMMs.exe
<Current directory>\OccY.ico
C:\RCX88.tmp
<Current directory>\ZAEY.ico
<Current directory>\LcUy.exe
C:\RCX87.tmp
<Current directory>\Pgwa.ico
<Current directory>\wIQG.exe
C:\RCX89.tmp
<Current directory>\hcEQ.ico
<Current directory>\hMUI.exe
C:\RCX8B.tmp
<Current directory>\HkYQ.ico
<Current directory>\ZsEY.exe
C:\RCX8A.tmp
<Current directory>\NAUa.exe
C:\RCX84.tmp
<Current directory>\KYoi.ico
<Current directory>\tAoo.exe
C:\RCX83.tmp
<Current directory>\AoMc.ico
<Current directory>\nwsM.exe
C:\RCX86.tmp
<Current directory>\XQEy.ico
<Current directory>\Rwoi.exe
C:\RCX85.tmp
<Current directory>\qMMg.ico
<Current directory>\cUYg.exe
<Current directory>\tAoC.ico
C:\RCX6D.tmp
<Current directory>\nIAs.ico
<Current directory>\yIQY.exe
C:\RCX6C.tmp
<Current directory>\vgcQ.ico
<Current directory>\ekoq.exe
C:\RCX6E.tmp
<Current directory>\zYIo.ico
<Current directory>\tcwM.exe
C:\RCX70.tmp
<Current directory>\qEkw.ico
<Current directory>\BEIU.exe
C:\RCX6F.tmp
<Current directory>\nIMi.exe
C:\RCX69.tmp
<Current directory>\DQEM.ico
<Current directory>\eske.exe
C:\RCX68.tmp
<Current directory>\iccg.ico
<Current directory>\GgMW.exe
C:\RCX6B.tmp
<Current directory>\gowW.ico
<Current directory>\VAoU.exe
C:\RCX6A.tmp
<Current directory>\zkEk.ico
<Current directory>\fEwo.exe
<Current directory>\QsgM.ico
C:\RCX76.tmp
<Current directory>\DEsQ.ico
<Current directory>\Akwg.exe
C:\RCX75.tmp
<Current directory>\lQgi.ico
<Current directory>\acks.exe
C:\RCX77.tmp
<Current directory>\Kgwe.ico
<Current directory>\wAgg.exe
C:\RCX79.tmp
<Current directory>\OQww.ico
<Current directory>\NIsg.exe
C:\RCX78.tmp
<Current directory>\qYgS.exe
C:\RCX72.tmp
<Current directory>\WAIe.ico
<Current directory>\RQcE.exe
C:\RCX71.tmp
<Current directory>\SIgS.ico
<Current directory>\tAQS.exe
C:\RCX74.tmp
<Current directory>\MYES.ico
<Current directory>\ukII.exe
C:\RCX73.tmp
<Current directory>\yogq.ico
<Current directory>\qwow.exe
C:\RCX14.tmp
<Current directory>\bQIq.ico
<Current directory>\hYkg.exe
C:\RCX13.tmp
<Current directory>\iQUk.ico
<Current directory>\ZkQM.exe
C:\RCX15.tmp
<Current directory>\GEYc.ico
<Current directory>\fAMQ.exe
C:\RCX17.tmp
<Current directory>\goYS.ico
<Current directory>\TYIa.exe
C:\RCX16.tmp
<Current directory>\UoEo.exe
C:\RCX10.tmp
<Current directory>\MIUa.ico
<Current directory>\Gskk.exe
C:\RCXF.tmp
<Current directory>\bEMQ.ico
<Current directory>\GkYM.exe
C:\RCX12.tmp
<Current directory>\XUMq.ico
<Current directory>\CcEy.exe
C:\RCX11.tmp
<Current directory>\CoUA.ico
<Current directory>\sIUm.exe
<Current directory>\cosm.ico
C:\RCX1D.tmp
<Current directory>\gUEi.ico
<Current directory>\lYwS.exe
C:\RCX1C.tmp
<Current directory>\lsgI.ico
<Current directory>\ZYcS.exe
C:\RCX1E.tmp
<Current directory>\BQAG.ico
<Current directory>\nQcQ.exe
C:\RCX20.tmp
<Current directory>\qgIK.ico
<Current directory>\IUUG.exe
C:\RCX1F.tmp
<Current directory>\XAwQ.exe
C:\RCX19.tmp
<Current directory>\GAEq.ico
<Current directory>\OwQo.exe
C:\RCX18.tmp
<Current directory>\MwkG.ico
<Current directory>\tkEG.exe
C:\RCX1B.tmp
<Current directory>\YkYI.ico
<Current directory>\hwga.exe
C:\RCX1A.tmp
<Current directory>\UQIo.ico
<Current directory>\Kcso.exe
<Current directory>\WoEc.ico
C:\RCX2.tmp
<Current directory>\lIYK.ico
<Current directory>\YkMM.exe
C:\RCX1.tmp
<Current directory>\NMQo.ico
<Current directory>\EQYk.exe
C:\RCX3.tmp
<Current directory>\eoMS.ico
<Current directory>\sAkA.exe
C:\RCX5.tmp
<Current directory>\rwMu.ico
<Current directory>\iQcw.exe
C:\RCX4.tmp
%TEMP%\vcredist_x86.exe
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\wixstdba.dll
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.xml
%HOMEPATH%\f.inf
%TEMP%\ywMkcUoQ.bat
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.wxl
%TEMP%\dd_vcredist_x86_20140822164824.log
<Current directory>\FYIU.ico
<Current directory>\lsIG.exe
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\logo.png
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\license.rtf
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\BootstrapperApplicationData.xml
<Current directory>\LMIA.ico
C:\RCXB.tmp
<Current directory>\Ecgi.ico
<Current directory>\aQUC.exe
C:\RCXA.tmp
<Current directory>\pgMy.ico
<Current directory>\Wssi.exe
C:\RCXC.tmp
<Current directory>\Bkcg.ico
<Current directory>\acAo.exe
C:\RCXE.tmp
<Current directory>\hEka.ico
<Current directory>\eMYi.exe
C:\RCXD.tmp
<Current directory>\ZUAE.exe
C:\RCX7.tmp
<Current directory>\dsco.ico
<Current directory>\dQso.exe
C:\RCX6.tmp
<Current directory>\xQUK.ico
<Current directory>\agku.exe
C:\RCX9.tmp
<Current directory>\cIcY.ico
<Current directory>\wYMK.exe
C:\RCX8.tmp
<Current directory>\pAQM.ico
<Current directory>\ToQi.exe
<Current directory>\csEE.exe
C:\RCX38.tmp
<Current directory>\ycsM.ico
<Current directory>\wEYi.exe
C:\RCX37.tmp
<Current directory>\UIkS.ico
<Current directory>\EkAG.exe
C:\RCX3A.tmp
<Current directory>\mQMM.ico
<Current directory>\acss.exe
C:\RCX39.tmp
<Current directory>\OAco.ico
<Current directory>\bsIO.exe
<Current directory>\DooI.ico
<Current directory>\PQUS.exe
C:\RCX34.tmp
<Current directory>\eMoy.ico
<Current directory>\iUcw.exe
C:\RCX33.tmp
<Current directory>\jwYU.ico
<Current directory>\bEUq.exe
C:\RCX36.tmp
<Current directory>\CUIE.ico
<Current directory>\cgMU.exe
C:\RCX35.tmp
<Current directory>\QcIC.ico
C:\RCX3B.tmp
<Current directory>\LIUs.exe
C:\RCX41.tmp
<Current directory>\ssAA.ico
<Current directory>\RYAm.exe
C:\RCX40.tmp
<Current directory>\hsws.ico
<Current directory>\WQEM.exe
C:\RCX43.tmp
<Current directory>\qIsE.ico
<Current directory>\pMMW.exe
C:\RCX42.tmp
<Current directory>\PsgO.ico
<Current directory>\XogU.exe
<Current directory>\OkcO.ico
<Current directory>\BoYA.exe
C:\RCX3D.tmp
<Current directory>\MEMW.ico
<Current directory>\gsgo.exe
C:\RCX3C.tmp
<Current directory>\XAgE.ico
<Current directory>\gQoM.exe
C:\RCX3F.tmp
<Current directory>\YMEA.ico
<Current directory>\vcsy.exe
C:\RCX3E.tmp
<Current directory>\SssA.ico
C:\RCX32.tmp
<Current directory>\okso.exe
C:\RCX26.tmp
<Current directory>\Nkcm.ico
<Current directory>\ywAa.exe
C:\RCX25.tmp
<Current directory>\gMQs.ico
<Current directory>\VEsS.exe
C:\RCX28.tmp
<Current directory>\gkko.ico
<Current directory>\cAkA.exe
C:\RCX27.tmp
<Current directory>\HksM.ico
<Current directory>\ZsYe.exe
<Current directory>\xQQI.ico
<Current directory>\awEI.exe
C:\RCX22.tmp
<Current directory>\IcoE.ico
<Current directory>\FoIu.exe
C:\RCX21.tmp
<Current directory>\FYke.ico
<Current directory>\rYYQ.exe
C:\RCX24.tmp
<Current directory>\WsAA.ico
<Current directory>\wAEC.exe
C:\RCX23.tmp
<Current directory>\GAca.ico
C:\RCX29.tmp
<Current directory>\cksa.exe
C:\RCX2F.tmp
<Current directory>\WsIm.ico
<Current directory>\owcE.exe
C:\RCX2E.tmp
<Current directory>\YQAc.ico
<Current directory>\TkgG.exe
C:\RCX31.tmp
<Current directory>\HoUq.ico
<Current directory>\Gosa.exe
C:\RCX30.tmp
<Current directory>\bUQC.ico
<Current directory>\AoIk.exe
<Current directory>\DwoU.ico
<Current directory>\hkse.exe
C:\RCX2B.tmp
<Current directory>\sMIg.ico
<Current directory>\agEi.exe
C:\RCX2A.tmp
<Current directory>\owME.ico
<Current directory>\uoIk.exe
C:\RCX2D.tmp
<Current directory>\NwcU.ico
<Current directory>\fQUM.exe
C:\RCX2C.tmp
<Current directory>\fMoQ.ico

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe

Deletes the following files:

<Current directory>\uwcO.ico
<Current directory>\PkAi.exe
<Current directory>\HkwA.ico
<Current directory>\zQMG.exe
<Current directory>\pYoC.ico
<Current directory>\MsUG.exe
<Current directory>\HUAw.ico
<Current directory>\ywwW.exe
<Current directory>\XkIU.exe
<Current directory>\WAoM.exe
<Current directory>\PIAG.ico
<Current directory>\bowm.exe
<Current directory>\qYUq.ico
<Current directory>\JgAk.exe
<Current directory>\GIkA.ico
<Current directory>\Vscm.exe
<Current directory>\OsYs.ico
<Current directory>\zwgA.exe
<Current directory>\UswW.ico
<Current directory>\skoo.exe
<Current directory>\gMoa.ico
<Current directory>\eske.exe
<Current directory>\iEEu.ico
<Current directory>\tcoW.exe
<Current directory>\WYIe.ico
<Current directory>\iIku.ico
<Current directory>\GAIy.ico
<Current directory>\loAw.exe
<Current directory>\xkQu.ico
<Current directory>\wsYS.exe
<Current directory>\cYIw.ico
<Current directory>\Fkwu.exe
<Current directory>\KAAK.ico
<Current directory>\VwMk.exe
<Current directory>\WYMW.ico
<Current directory>\XgMG.exe
<Current directory>\psky.ico
<Current directory>\oQgG.exe
<Current directory>\boAi.ico
<Current directory>\eUYM.exe
<Current directory>\zckw.ico
<Current directory>\KsMC.exe
<Current directory>\Qkcu.ico
<Current directory>\XAAK.ico
<Current directory>\AssM.ico
<Current directory>\SwkI.exe
<Current directory>\tMYc.ico
<Current directory>\aUAk.exe
<Current directory>\uwAi.ico
<Current directory>\YgAA.exe
<Current directory>\ooku.ico
<Current directory>\ZIsc.exe
<Current directory>\IMcg.ico
<Current directory>\pcEC.exe
<Current directory>\aIwq.ico
<Current directory>\IcEs.exe
<Current directory>\vQgm.ico
<Current directory>\DUIc.exe
<Current directory>\oAYk.ico
<Current directory>\Hwou.exe
<Current directory>\VwIg.exe
<Current directory>\NAEo.exe
<Current directory>\Xowq.ico
<Current directory>\oowi.exe
<Current directory>\WIYC.ico
<Current directory>\ZIEm.exe
<Current directory>\sEEM.ico
<Current directory>\dUEI.exe
<Current directory>\vQge.ico
<Current directory>\nIMi.exe
<Current directory>\dEkw.ico
<Current directory>\sggA.exe
<Current directory>\kkIg.ico
<Current directory>\QAkC.exe
<Current directory>\sYMs.ico
<Current directory>\tAoo.exe
<Current directory>\Pkku.ico
<Current directory>\Asgi.exe
<Current directory>\EYQs.exe
<Current directory>\asUM.exe
<Current directory>\dsga.ico
<Current directory>\zsQC.exe
<Current directory>\LAky.ico
<Current directory>\Dcgg.exe
<Current directory>\nwYu.ico
<Current directory>\cMMs.exe
<Current directory>\sQUM.ico
<Current directory>\LcUy.exe
<Current directory>\ZAEY.ico
<Current directory>\wIQG.exe
<Current directory>\Pgwa.ico
<Current directory>\hMUI.exe
<Current directory>\hcEQ.ico
<Current directory>\ZsEY.exe
<Current directory>\HkYQ.ico
<Current directory>\XQEy.ico
<Current directory>\AoMc.ico
<Current directory>\nwsM.exe
<Current directory>\OccY.ico
<Current directory>\NAUa.exe
<Current directory>\qMMg.ico
<Current directory>\Rwoi.exe
<Current directory>\KYoi.ico
<Current directory>\cUYg.exe
<Current directory>\tAoC.ico
<Current directory>\BEIU.exe
<Current directory>\qEkw.ico
<Current directory>\yIQY.exe
<Current directory>\nIAs.ico
<Current directory>\RQcE.exe
<Current directory>\QsgM.ico
<Current directory>\tcwM.exe
<Current directory>\zYIo.ico
<Current directory>\vgcQ.ico
<Current directory>\DQEM.ico
<Current directory>\fEwo.exe
<Current directory>\iccg.ico
<Current directory>\GgMW.exe
<Current directory>\gowW.ico
<Current directory>\ekoq.exe
<Current directory>\zkEk.ico
<Current directory>\VAoU.exe
<Current directory>\DEsQ.ico
<Current directory>\NIsg.exe
<Current directory>\lQgi.ico
<Current directory>\Akwg.exe
<Current directory>\Kgwe.ico
<Current directory>\jsoy.exe
<Current directory>\OQww.ico
<Current directory>\wAgg.exe
<Current directory>\acks.exe
<Current directory>\tAQS.exe
<Current directory>\WAIe.ico
<Current directory>\qYgS.exe
<Current directory>\SIgS.ico
<Current directory>\ukII.exe
<Current directory>\MYES.ico
<Current directory>\qwow.exe
<Current directory>\yogq.ico
<Current directory>\UAss.exe
<Current directory>\GEYc.ico
<Current directory>\OwQo.exe
<Current directory>\goYS.ico
<Current directory>\fAMQ.exe
<Current directory>\MwkG.ico
<Current directory>\tkEG.exe
<Current directory>\cosm.ico
<Current directory>\XAwQ.exe
<Current directory>\TYIa.exe
<Current directory>\CcEy.exe
<Current directory>\XUMq.ico
<Current directory>\sIUm.exe
<Current directory>\CoUA.ico
<Current directory>\hYkg.exe
<Current directory>\bQIq.ico
<Current directory>\ZkQM.exe
<Current directory>\iQUk.ico
<Current directory>\nQcQ.exe
<Current directory>\BQAG.ico
<Current directory>\IUUG.exe
<Current directory>\qgIK.ico
<Current directory>\awEI.exe
<Current directory>\xQQI.ico
<Current directory>\FoIu.exe
<Current directory>\IcoE.ico
<Current directory>\gUEi.ico
<Current directory>\UQIo.ico
<Current directory>\hwga.exe
<Current directory>\GAEq.ico
<Current directory>\Kcso.exe
<Current directory>\lsgI.ico
<Current directory>\lYwS.exe
<Current directory>\YkYI.ico
<Current directory>\ZYcS.exe
<Current directory>\MIUa.ico
<Current directory>\dQso.exe
<Current directory>\LMIA.ico
<Current directory>\sAkA.exe
<Current directory>\eoMS.ico
<Current directory>\agku.exe
<Current directory>\dsco.ico
<Current directory>\ZUAE.exe
<Current directory>\xQUK.ico
<Current directory>\rwMu.ico
<Current directory>\FYIU.ico
<Current directory>\EQYk.exe
%TEMP%\ywMkcUoQ.bat
<Current directory>\lsIG.exe
<Current directory>\lIYK.ico
<Current directory>\iQcw.exe
<Current directory>\NMQo.ico
<Current directory>\YkMM.exe
<Current directory>\Bkcg.ico
<Current directory>\Gskk.exe
<Current directory>\hEka.ico
<Current directory>\acAo.exe
<Current directory>\bEMQ.ico
<Current directory>\GkYM.exe
<Current directory>\WoEc.ico
<Current directory>\UoEo.exe
<Current directory>\eMYi.exe
<Current directory>\wYMK.exe
<Current directory>\cIcY.ico
<Current directory>\ToQi.exe
<Current directory>\pAQM.ico
<Current directory>\aQUC.exe
<Current directory>\Ecgi.ico
<Current directory>\Wssi.exe
<Current directory>\pgMy.ico
<Current directory>\wAEC.exe
<Current directory>\OAco.ico
<Current directory>\acss.exe
<Current directory>\ycsM.ico
<Current directory>\bsIO.exe
<Current directory>\MEMW.ico
<Current directory>\BoYA.exe
<Current directory>\mQMM.ico
<Current directory>\gsgo.exe
<Current directory>\EkAG.exe
<Current directory>\bEUq.exe
<Current directory>\QcIC.ico
<Current directory>\cgMU.exe
<Current directory>\jwYU.ico
<Current directory>\csEE.exe
<Current directory>\UIkS.ico
<Current directory>\wEYi.exe
<Current directory>\CUIE.ico
<Current directory>\XogU.exe
<Current directory>\PsgO.ico
<Current directory>\WQEM.exe
<Current directory>\ssAA.ico
<Current directory>\QkEC.exe
<Current directory>\OgMy.ico
<Current directory>\pMMW.exe
<Current directory>\qIsE.ico
<Current directory>\hsws.ico
<Current directory>\XAgE.ico
<Current directory>\gQoM.exe
<Current directory>\OkcO.ico
<Current directory>\vcsy.exe
<Current directory>\YMEA.ico
<Current directory>\LIUs.exe
<Current directory>\SssA.ico
<Current directory>\RYAm.exe
<Current directory>\DooI.ico
<Current directory>\cAkA.exe
<Current directory>\gkko.ico
<Current directory>\ZsYe.exe
<Current directory>\HksM.ico
<Current directory>\hkse.exe
<Current directory>\DwoU.ico
<Current directory>\agEi.exe
<Current directory>\sMIg.ico
<Current directory>\Nkcm.ico
<Current directory>\GAca.ico
<Current directory>\ywAa.exe
<Current directory>\FYke.ico
<Current directory>\rYYQ.exe
<Current directory>\gMQs.ico
<Current directory>\VEsS.exe
<Current directory>\WsAA.ico
<Current directory>\okso.exe
<Current directory>\bUQC.ico
<Current directory>\Gosa.exe
<Current directory>\WsIm.ico
<Current directory>\AoIk.exe
<Current directory>\eMoy.ico
<Current directory>\PQUS.exe
<Current directory>\HoUq.ico
<Current directory>\iUcw.exe
<Current directory>\TkgG.exe
<Current directory>\uoIk.exe
<Current directory>\fMoQ.ico
<Current directory>\fQUM.exe
<Current directory>\owME.ico
<Current directory>\cksa.exe
<Current directory>\YQAc.ico
<Current directory>\owcE.exe
<Current directory>\NwcU.ico

Moves the following files:

from C:\RCX5D.tmp to <Current directory>\zQMG.exe
from C:\RCX5C.tmp to <Current directory>\XkIU.exe
from C:\RCX5F.tmp to <Current directory>\ywwW.exe
from C:\RCX5E.tmp to <Current directory>\PkAi.exe
from C:\RCX59.tmp to <Current directory>\WAoM.exe
from C:\RCX58.tmp to <Current directory>\bowm.exe
from C:\RCX5B.tmp to <Current directory>\JgAk.exe
from C:\RCX5A.tmp to <Current directory>\Vscm.exe
from C:\RCX60.tmp to <Current directory>\MsUG.exe
from C:\RCX66.tmp to <Current directory>\zwgA.exe
from C:\RCX65.tmp to <Current directory>\skoo.exe
from C:\RCX68.tmp to <Current directory>\eske.exe
from C:\RCX67.tmp to <Current directory>\tcoW.exe
from C:\RCX62.tmp to <Current directory>\loAw.exe
from C:\RCX61.tmp to <Current directory>\wsYS.exe
from C:\RCX64.tmp to <Current directory>\Fkwu.exe
from C:\RCX63.tmp to <Current directory>\VwMk.exe
from C:\RCX4C.tmp to <Current directory>\XgMG.exe
from C:\RCX4B.tmp to <Current directory>\oQgG.exe
from C:\RCX4E.tmp to <Current directory>\eUYM.exe
from C:\RCX4D.tmp to <Current directory>\KsMC.exe
from C:\RCX48.tmp to <Current directory>\SwkI.exe
from C:\RCX47.tmp to <Current directory>\aUAk.exe
from C:\RCX4A.tmp to <Current directory>\YgAA.exe
from C:\RCX49.tmp to <Current directory>\ZIsc.exe
from C:\RCX4F.tmp to <Current directory>\oowi.exe
from C:\RCX55.tmp to <Current directory>\pcEC.exe
from C:\RCX54.tmp to <Current directory>\IcEs.exe
from C:\RCX57.tmp to <Current directory>\DUIc.exe
from C:\RCX56.tmp to <Current directory>\Hwou.exe
from C:\RCX51.tmp to <Current directory>\dUEI.exe
from C:\RCX50.tmp to <Current directory>\NAEo.exe
from C:\RCX53.tmp to <Current directory>\VwIg.exe
from C:\RCX52.tmp to <Current directory>\ZIEm.exe
from C:\RCX69.tmp to <Current directory>\nIMi.exe
from C:\RCX80.tmp to <Current directory>\QAkC.exe
from C:\RCX7F.tmp to <Current directory>\EYQs.exe
from C:\RCX82.tmp to <Current directory>\Asgi.exe
from C:\RCX81.tmp to <Current directory>\sggA.exe
from C:\RCX7C.tmp to <Current directory>\asUM.exe
from C:\RCX7B.tmp to <Current directory>\zsQC.exe
from C:\RCX7E.tmp to <Current directory>\Dcgg.exe
from C:\RCX7D.tmp to <Current directory>\cMMs.exe
from C:\RCX83.tmp to <Current directory>\tAoo.exe
from C:\RCX89.tmp to <Current directory>\LcUy.exe
from C:\RCX88.tmp to <Current directory>\wIQG.exe
from C:\RCX8B.tmp to <Current directory>\hMUI.exe
from C:\RCX8A.tmp to <Current directory>\ZsEY.exe
from C:\RCX85.tmp to <Current directory>\nwsM.exe
from C:\RCX84.tmp to <Current directory>\NAUa.exe
from C:\RCX87.tmp to <Current directory>\Rwoi.exe
from C:\RCX86.tmp to <Current directory>\cUYg.exe
from C:\RCX6F.tmp to <Current directory>\BEIU.exe
from C:\RCX6E.tmp to <Current directory>\yIQY.exe
from C:\RCX71.tmp to <Current directory>\RQcE.exe
from C:\RCX70.tmp to <Current directory>\tcwM.exe
from C:\RCX6B.tmp to <Current directory>\fEwo.exe
from C:\RCX6A.tmp to <Current directory>\GgMW.exe
from C:\RCX6D.tmp to <Current directory>\ekoq.exe
from C:\RCX6C.tmp to <Current directory>\VAoU.exe
from C:\RCX72.tmp to <Current directory>\qYgS.exe
from C:\RCX78.tmp to <Current directory>\NIsg.exe
from C:\RCX77.tmp to <Current directory>\Akwg.exe
from C:\RCX7A.tmp to <Current directory>\jsoy.exe
from C:\RCX79.tmp to <Current directory>\wAgg.exe
from C:\RCX74.tmp to <Current directory>\qwow.exe
from C:\RCX73.tmp to <Current directory>\tAQS.exe
from C:\RCX76.tmp to <Current directory>\acks.exe
from C:\RCX75.tmp to <Current directory>\ukII.exe
from C:\RCX46.tmp to <Current directory>\UAss.exe
from C:\RCX17.tmp to <Current directory>\fAMQ.exe
from C:\RCX16.tmp to <Current directory>\TYIa.exe
from C:\RCX19.tmp to <Current directory>\XAwQ.exe
from C:\RCX18.tmp to <Current directory>\OwQo.exe
from C:\RCX13.tmp to <Current directory>\CcEy.exe
from C:\RCX12.tmp to <Current directory>\sIUm.exe
from C:\RCX15.tmp to <Current directory>\hYkg.exe
from C:\RCX14.tmp to <Current directory>\ZkQM.exe
from C:\RCX1A.tmp to <Current directory>\tkEG.exe
from C:\RCX20.tmp to <Current directory>\nQcQ.exe
from C:\RCX1F.tmp to <Current directory>\IUUG.exe
from C:\RCX22.tmp to <Current directory>\awEI.exe
from C:\RCX21.tmp to <Current directory>\FoIu.exe
from C:\RCX1C.tmp to <Current directory>\hwga.exe
from C:\RCX1B.tmp to <Current directory>\Kcso.exe
from C:\RCX1E.tmp to <Current directory>\lYwS.exe
from C:\RCX1D.tmp to <Current directory>\ZYcS.exe
from C:\RCX6.tmp to <Current directory>\dQso.exe
from C:\RCX5.tmp to <Current directory>\sAkA.exe
from C:\RCX8.tmp to <Current directory>\agku.exe
from C:\RCX7.tmp to <Current directory>\ZUAE.exe
from C:\RCX2.tmp to <Current directory>\EQYk.exe
from C:\RCX1.tmp to <Current directory>\lsIG.exe
from C:\RCX4.tmp to <Current directory>\iQcw.exe
from C:\RCX3.tmp to <Current directory>\YkMM.exe
from C:\RCX9.tmp to <Current directory>\ToQi.exe
from C:\RCXF.tmp to <Current directory>\Gskk.exe
from C:\RCXE.tmp to <Current directory>\acAo.exe
from C:\RCX11.tmp to <Current directory>\GkYM.exe
from C:\RCX10.tmp to <Current directory>\UoEo.exe
from C:\RCXB.tmp to <Current directory>\Wssi.exe
from C:\RCXA.tmp to <Current directory>\wYMK.exe
from C:\RCXD.tmp to <Current directory>\eMYi.exe
from C:\RCXC.tmp to <Current directory>\aQUC.exe
from C:\RCX23.tmp to <Current directory>\wAEC.exe
from C:\RCX3A.tmp to <Current directory>\bsIO.exe
from C:\RCX39.tmp to <Current directory>\EkAG.exe
from C:\RCX3C.tmp to <Current directory>\gsgo.exe
from C:\RCX3B.tmp to <Current directory>\acss.exe
from C:\RCX36.tmp to <Current directory>\bEUq.exe
from C:\RCX35.tmp to <Current directory>\cgMU.exe
from C:\RCX38.tmp to <Current directory>\csEE.exe
from C:\RCX37.tmp to <Current directory>\wEYi.exe
from C:\RCX3D.tmp to <Current directory>\BoYA.exe
from C:\RCX43.tmp to <Current directory>\XogU.exe
from C:\RCX42.tmp to <Current directory>\WQEM.exe
from C:\RCX45.tmp to <Current directory>\QkEC.exe
from C:\RCX44.tmp to <Current directory>\pMMW.exe
from C:\RCX3F.tmp to <Current directory>\gQoM.exe
from C:\RCX3E.tmp to <Current directory>\vcsy.exe
from C:\RCX41.tmp to <Current directory>\LIUs.exe
from C:\RCX40.tmp to <Current directory>\RYAm.exe
from C:\RCX29.tmp to <Current directory>\cAkA.exe
from C:\RCX28.tmp to <Current directory>\ZsYe.exe
from C:\RCX2B.tmp to <Current directory>\hkse.exe
from C:\RCX2A.tmp to <Current directory>\agEi.exe
from C:\RCX25.tmp to <Current directory>\ywAa.exe
from C:\RCX24.tmp to <Current directory>\rYYQ.exe
from C:\RCX27.tmp to <Current directory>\VEsS.exe
from C:\RCX26.tmp to <Current directory>\okso.exe
from C:\RCX2C.tmp to <Current directory>\fQUM.exe
from C:\RCX32.tmp to <Current directory>\Gosa.exe
from C:\RCX31.tmp to <Current directory>\AoIk.exe
from C:\RCX34.tmp to <Current directory>\PQUS.exe
from C:\RCX33.tmp to <Current directory>\iUcw.exe
from C:\RCX2E.tmp to <Current directory>\owcE.exe
from C:\RCX2D.tmp to <Current directory>\uoIk.exe
from C:\RCX30.tmp to <Current directory>\TkgG.exe
from C:\RCX2F.tmp to <Current directory>\cksa.exe

Network activity:

Connects to:

'19#.#86.45.170':9999
'74.##5.232.51':80
'20#.#7.164.69':9999
'20#.#19.204.12':9999

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial