Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'
- hidden files
- file extensions
- User Account Control (UAC)
- '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
- '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qgwowcYA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FUooEcgY.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\wAgQEwgg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\lEcMQUIM.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MqAAQwYc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PsUcYEQA.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=5980
- '<SYSTEM32>\reg.exe' %TEMP%\file.vbs
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qGMcQUAE.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\aEQkEkMs.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\nyoAEwsQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qeswIUws.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\aCgAgwMY.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\uussMUog.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2756
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\hmkYEgIo.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3208
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qcYocoko.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PSEoEkEg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\nusUsAcc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tsgQEYMA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\fmAMwkoA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\vUUMUskY.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2968
- '<SYSTEM32>\cscript.exe' /c ""%TEMP%\OWcEUUMM.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=4132
- '<SYSTEM32>\reg.exe' /pid=2908
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\vuoYgEIE.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=4432
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\SWQIUAsA.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=4572
- '<SYSTEM32>\reg.exe' /pid=4404
- '<SYSTEM32>\cscript.exe' /pid=4272
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\uMQIsUQs.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3064
- '<SYSTEM32>\reg.exe' /pid=3816
- '<SYSTEM32>\reg.exe' /pid=3896
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\tEMYIEkk.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3996
- '<SYSTEM32>\reg.exe' /pid=6036
- '<SYSTEM32>\cscript.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\DIsYAEkg.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=3408
- '<SYSTEM32>\reg.exe' /pid=284
- '<SYSTEM32>\cscript.exe' /pid=2392
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\feYAgoME.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PcYEUMQg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\YWAwcYkc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\LKEEoIwU.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\dgQQgAAQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\HQQwUIso.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\jmIUEYow.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=500
- '<SYSTEM32>\reg.exe' /c "<Current directory>\<Virus name>"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\QGsQAIYQ.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe'
- '<SYSTEM32>\reg.exe' /pid=3908
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FgAsIUkA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\oGkoIQEk.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WugMksMk.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\aiwIEAAY.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PSIsUgsc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MisQAQgQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\gAEcUoIA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\TEoUoMAo.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3728
- '<SYSTEM32>\cscript.exe' /pid=3872
- '<SYSTEM32>\cscript.exe' /pid=4012
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\QAIsQUYw.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\myYIQQMw.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=1532
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\SgMQQEkM.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=776
- '<SYSTEM32>\reg.exe' /pid=2740
- '<SYSTEM32>\cscript.exe' /pid=240
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEogEkwo.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=3468
- '<SYSTEM32>\reg.exe' /pid=2832
- '<SYSTEM32>\reg.exe' /pid=3088
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qeQMgEMw.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=1364
- '<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' /pid=2676
- '<SYSTEM32>\reg.exe' /pid=3528
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\DIMQYwow.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=3208
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ygIQkEAk.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3220
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\reg.exe
- <Current directory>\sAwK.exe
- C:\RCX39.tmp
- <Current directory>\IQsQ.ico
- <Current directory>\uQMC.exe
- C:\RCX38.tmp
- %TEMP%\aEQkEkMs.bat
- C:\RCX3A.tmp
- <Current directory>\vMUi.ico
- <Current directory>\VcIQ.exe
- %TEMP%\yqcsoQYY.bat
- <Current directory>\hwcy.ico
- <Current directory>\aAIK.ico
- <Current directory>\UUIq.exe
- C:\RCX35.tmp
- %TEMP%\EKoYYkoI.bat
- C:\RCX34.tmp
- <Current directory>\SMEy.ico
- <Current directory>\fQUO.ico
- <Current directory>\rkYI.exe
- C:\RCX37.tmp
- <Current directory>\Okge.ico
- <Current directory>\VsQU.exe
- C:\RCX36.tmp
- <Current directory>\HwQE.exe
- C:\RCX3F.tmp
- <Current directory>\kEAy.ico
- C:\RCX3E.tmp
- %TEMP%\qGMcQUAE.bat
- <Current directory>\mEYw.ico
- <Current directory>\pkoI.exe
- C:\RCX41.tmp
- <Current directory>\tUEU.ico
- <Current directory>\igwo.exe
- C:\RCX40.tmp
- <Current directory>\vAoe.exe
- <Current directory>\UAYY.exe
- %TEMP%\nyoAEwsQ.bat
- <Current directory>\bEoK.ico
- <Current directory>\dcQi.exe
- C:\RCX3B.tmp
- C:\RCX3C.tmp
- C:\RCX3D.tmp
- <Current directory>\oksK.ico
- <Current directory>\Ykci.exe
- <Current directory>\PQAW.ico
- %TEMP%\gIgEYQQU.bat
- <Current directory>\qgoY.exe
- C:\RCX2B.tmp
- <Current directory>\lgsA.ico
- <Current directory>\hgge.exe
- C:\RCX2A.tmp
- <Current directory>\TkIS.ico
- <Current directory>\xQAo.exe
- C:\RCX2D.tmp
- <Current directory>\fIAa.ico
- <Current directory>\zAcE.exe
- C:\RCX2C.tmp
- <Current directory>\osIw.ico
- %TEMP%\NsUkAEkA.bat
- <Current directory>\VUII.exe
- C:\RCX28.tmp
- <Current directory>\aAQC.ico
- %TEMP%\MqAAQwYc.bat
- %TEMP%\SMQYoIgo.bat
- <Current directory>\nAwY.ico
- <Current directory>\AskG.ico
- <Current directory>\Ncom.exe
- %TEMP%\wAgQEwgg.bat
- <Current directory>\tgMg.exe
- C:\RCX29.tmp
- <Current directory>\OQcw.ico
- <Current directory>\Pogc.exe
- %TEMP%\dewIocYI.bat
- <Current directory>\dYMG.exe
- C:\RCX31.tmp
- C:\RCX32.tmp
- %TEMP%\PsUcYEQA.bat
- <Current directory>\RMIg.ico
- C:\RCX33.tmp
- <Current directory>\AQQg.ico
- <Current directory>\IIwy.exe
- <Current directory>\VEIK.ico
- %TEMP%\lAUEUkAs.bat
- <Current directory>\mwAi.ico
- C:\RCX2E.tmp
- <Current directory>\Ckgm.exe
- %TEMP%\qgwowcYA.bat
- <Current directory>\MscQ.exe
- C:\RCX30.tmp
- %TEMP%\FUooEcgY.bat
- <Current directory>\zoku.exe
- C:\RCX2F.tmp
- <Current directory>\zEws.ico
- %TEMP%\kMgAAgMc.bat
- %TEMP%\OWcEUUMM.bat
- <Current directory>\UYQa.ico
- C:\RCX53.tmp
- <Current directory>\vUIC.ico
- <Current directory>\ikUe.exe
- <Current directory>\cwwq.exe
- %TEMP%\tqoYQock.bat
- C:\RCX55.tmp
- <Current directory>\HQEi.exe
- C:\RCX54.tmp
- <Current directory>\RAAs.ico
- C:\RCX52.tmp
- C:\RCX50.tmp
- %TEMP%\vuoYgEIE.bat
- <Current directory>\PosQ.exe
- C:\RCX4F.tmp
- <Current directory>\QsYq.ico
- <Current directory>\IUsY.ico
- <Current directory>\BYAq.ico
- <Current directory>\DYcw.exe
- %TEMP%\TekEkcIY.bat
- <Current directory>\fsoK.exe
- C:\RCX51.tmp
- <Current directory>\yUcc.exe
- C:\RCX5A.tmp
- <Current directory>\WswI.ico
- <Current directory>\oIwk.exe
- C:\RCX59.tmp
- <Current directory>\AIQE.ico
- <Current directory>\iMQi.exe
- %TEMP%\dSYEYoUY.bat
- C:\RCX5B.tmp
- <Current directory>\GoIA.exe
- %TEMP%\SWQIUAsA.bat
- <Current directory>\kkcC.ico
- <Current directory>\JQUU.ico
- <Current directory>\VscA.exe
- C:\RCX56.tmp
- <Current directory>\bEcu.ico
- <Current directory>\uEMm.exe
- C:\RCX57.tmp
- C:\RCX58.tmp
- %TEMP%\JSIwEUgM.bat
- <Current directory>\BsQw.exe
- %TEMP%\uMQIsUQs.bat
- <Current directory>\rIgu.ico
- <Current directory>\jogA.exe
- C:\RCX46.tmp
- <Current directory>\OUQM.ico
- <Current directory>\yQUQ.exe
- %TEMP%\tEMYIEkk.bat
- <Current directory>\QoAW.ico
- <Current directory>\xcog.exe
- <Current directory>\kYkW.exe
- C:\RCX48.tmp
- <Current directory>\TQkW.ico
- %TEMP%\xMUsgYkc.bat
- C:\RCX47.tmp
- C:\RCX45.tmp
- <Current directory>\QQQi.ico
- <Current directory>\qcAw.exe
- C:\RCX42.tmp
- <Current directory>\PwEO.ico
- <Current directory>\nkYY.exe
- C:\RCX43.tmp
- <Current directory>\IQQg.ico
- <Current directory>\UIos.exe
- C:\RCX44.tmp
- <Current directory>\UAQU.ico
- <Current directory>\NYkE.exe
- <Current directory>\lAYY.ico
- <Current directory>\awIk.exe
- %TEMP%\DIsYAEkg.bat
- <Current directory>\RUIy.exe
- C:\RCX4C.tmp
- C:\RCX4D.tmp
- %TEMP%\uQccYcIA.bat
- <Current directory>\loEE.ico
- C:\RCX4E.tmp
- <Current directory>\NMke.ico
- <Current directory>\EgMG.exe
- <Current directory>\YIwU.ico
- <Current directory>\dskS.ico
- <Current directory>\egkW.exe
- C:\RCX49.tmp
- <Current directory>\tUwM.ico
- <Current directory>\DooE.exe
- %TEMP%\feYAgoME.bat
- <Current directory>\WYcw.exe
- C:\RCX4B.tmp
- <Current directory>\uMcU.ico
- C:\RCX4A.tmp
- %TEMP%\bsAUMQYE.bat
- <Current directory>\skcM.ico
- <Current directory>\tIIc.exe
- C:\RCX4.tmp
- <Current directory>\rocc.ico
- <Current directory>\uYEy.exe
- C:\RCX5.tmp
- C:\RCX6.tmp
- <Current directory>\XQIS.ico
- <Current directory>\HsIu.exe
- %TEMP%\aCgAgwMY.bat
- <Current directory>\IYwY.ico
- C:\RCX3.tmp
- C:\RCX1.tmp
- <Current directory>\DQYW.ico
- <Current directory>\YgAw.exe
- %TEMP%\PawgwkAE.bat
- <Current directory>\RkQY.ico
- <Current directory>\FYko.exe
- %TEMP%\tOkwEYos.bat
- <Current directory>\Ckkg.exe
- <Current directory>\dEYK.ico
- C:\RCX2.tmp
- %TEMP%\hmkYEgIo.bat
- <Current directory>\MooC.ico
- <Current directory>\rwsu.exe
- C:\RCXB.tmp
- <Current directory>\XwUy.ico
- <Current directory>\DUwI.exe
- C:\RCXC.tmp
- C:\RCXD.tmp
- %TEMP%\LUIkcogw.bat
- <Current directory>\pcEG.exe
- %TEMP%\uussMUog.bat
- <Current directory>\LQIK.ico
- C:\RCXA.tmp
- <Current directory>\hEcE.ico
- <Current directory>\cIcu.exe
- %TEMP%\LScMoYcs.bat
- <Current directory>\xUgg.exe
- C:\RCX7.tmp
- C:\RCX8.tmp
- <Current directory>\DkcG.ico
- <Current directory>\msow.exe
- C:\RCX9.tmp
- <Current directory>\Nkcw.ico
- <Current directory>\zIgo.exe
- %TEMP%\SgMQQEkM.bat
- %TEMP%\iksQUcMg.bat
- %TEMP%\gSwAAwEE.bat
- %TEMP%\aiwIEAAY.bat
- %TEMP%\DSsoIMcU.bat
- %TEMP%\MisQAQgQ.bat
- %TEMP%\PSIsUgsc.bat
- %TEMP%\USAoYQIk.bat
- %TEMP%\HQQwUIso.bat
- %TEMP%\dgQQgAAQ.bat
- %TEMP%\FgAsIUkA.bat
- %TEMP%\viAsQksQ.bat
- %TEMP%\acoMogAI.bat
- %TEMP%\oGkoIQEk.bat
- %TEMP%\gCEgQsMY.bat
- <Current directory>\<Virus name>
- %TEMP%\kwIkEcEQ.bat
- %TEMP%\WugMksMk.bat
- %TEMP%\CKoAoQgY.bat
- %TEMP%\TEoUoMAo.bat
- %TEMP%\gAEcUoIA.bat
- %TEMP%\file.vbs
- %TEMP%\NEwEcIsY.bat
- %TEMP%\DIMQYwow.bat
- %TEMP%\VQQMIgwI.bat
- %TEMP%\CuQUwYIg.bat
- %TEMP%\PegswAMs.bat
- %TEMP%\ygIQkEAk.bat
- %TEMP%\cuIoMMMY.bat
- %TEMP%\xmYIEEYI.bat
- %TEMP%\CEogEkwo.bat
- %TEMP%\XGkgQQYM.bat
- %TEMP%\QAIsQUYw.bat
- %TEMP%\myYIQQMw.bat
- %TEMP%\qeQMgEMw.bat
- %TEMP%\agAksAYc.bat
- %TEMP%\PcYEUMQg.bat
- %TEMP%\RqEEQIYk.bat
- %TEMP%\PgYwwgsw.bat
- %TEMP%\LKEEoIwU.bat
- %TEMP%\eOogEgsM.bat
- %TEMP%\QGsQAIYQ.bat
- %TEMP%\eAkUkMcE.bat
- %TEMP%\gyskUQIY.bat
- %TEMP%\YWAwcYkc.bat
- %TEMP%\jmIUEYow.bat
- <Current directory>\tsca.ico
- C:\RCX1F.tmp
- %TEMP%\nusUsAcc.bat
- <Current directory>\GAYW.exe
- %TEMP%\uiowwwcY.bat
- <Current directory>\qEAE.ico
- %TEMP%\vSUQwAsk.bat
- C:\RCX20.tmp
- %TEMP%\icwAgoAw.bat
- %TEMP%\qeswIUws.bat
- <Current directory>\CAAc.ico
- <Current directory>\dksS.exe
- C:\RCX1E.tmp
- <Current directory>\nwQC.exe
- C:\RCX1C.tmp
- <Current directory>\OcMK.ico
- %TEMP%\tsgQEYMA.bat
- %TEMP%\toYUgsEA.bat
- <Current directory>\cYsY.ico
- <Current directory>\uIcW.ico
- <Current directory>\XwsM.exe
- %TEMP%\PSEoEkEg.bat
- <Current directory>\rgki.exe
- C:\RCX1D.tmp
- <Current directory>\TMkW.exe
- C:\RCX25.tmp
- %TEMP%\lEcMQUIM.bat
- %TEMP%\YuQggEAQ.bat
- <Current directory>\Fkkm.ico
- <Current directory>\FMMM.ico
- <Current directory>\sQwM.exe
- C:\RCX27.tmp
- <Current directory>\KYQi.ico
- <Current directory>\DEUe.exe
- C:\RCX26.tmp
- C:\RCX24.tmp
- <Current directory>\BQYK.ico
- <Current directory>\KMQg.exe
- C:\RCX21.tmp
- <Current directory>\UAwW.ico
- <Current directory>\HccA.exe
- C:\RCX22.tmp
- <Current directory>\xoAa.ico
- <Current directory>\sIUq.exe
- C:\RCX23.tmp
- <Current directory>\ngMW.ico
- <Current directory>\yMYw.exe
- C:\RCX1B.tmp
- C:\RCX12.tmp
- <Current directory>\ZYQy.ico
- <Current directory>\QEsw.exe
- <Current directory>\aYgI.ico
- %TEMP%\WeAYEQcI.bat
- <Current directory>\EUwI.exe
- C:\RCX14.tmp
- <Current directory>\Coge.ico
- <Current directory>\Wggg.exe
- C:\RCX13.tmp
- <Current directory>\DEAI.ico
- C:\RCX11.tmp
- <Current directory>\lAws.exe
- C:\RCXF.tmp
- <Current directory>\DYwK.ico
- <Current directory>\JsQa.exe
- C:\RCXE.tmp
- <Current directory>\togy.ico
- <Current directory>\rcQO.ico
- <Current directory>\yYUg.exe
- %TEMP%\qcYocoko.bat
- <Current directory>\wUMm.exe
- C:\RCX10.tmp
- C:\RCX19.tmp
- <Current directory>\ScgU.ico
- <Current directory>\uQcc.exe
- %TEMP%\uEMMgQcM.bat
- <Current directory>\uYYO.ico
- <Current directory>\vAIA.exe
- <Current directory>\DAcY.ico
- <Current directory>\okck.exe
- %TEMP%\zEYgYYMs.bat
- %TEMP%\vUUMUskY.bat
- C:\RCX1A.tmp
- C:\RCX18.tmp
- <Current directory>\Vkke.exe
- C:\RCX16.tmp
- <Current directory>\SEYy.ico
- <Current directory>\Fwks.exe
- C:\RCX15.tmp
- <Current directory>\xkUI.ico
- <Current directory>\wIcM.ico
- <Current directory>\KgIk.exe
- %TEMP%\fmAMwkoA.bat
- <Current directory>\DkAA.exe
- C:\RCX17.tmp
- %ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
- %HOMEPATH%\fCkYUMIQ\pUccUkoM.exe
- <Current directory>\hwcy.ico
- <Current directory>\VcIQ.exe
- <Current directory>\IQsQ.ico
- %TEMP%\yqcsoQYY.bat
- <Current directory>\UAYY.exe
- <Current directory>\vMUi.ico
- <Current directory>\dcQi.exe
- <Current directory>\rkYI.exe
- %TEMP%\EKoYYkoI.bat
- <Current directory>\fQUO.ico
- <Current directory>\Okge.ico
- <Current directory>\sAwK.exe
- <Current directory>\aAIK.ico
- <Current directory>\uQMC.exe
- <Current directory>\bEoK.ico
- <Current directory>\pkoI.exe
- <Current directory>\mEYw.ico
- <Current directory>\igwo.exe
- <Current directory>\tUEU.ico
- <Current directory>\qcAw.exe
- <Current directory>\PwEO.ico
- <Current directory>\nkYY.exe
- %TEMP%\gIgEYQQU.bat
- <Current directory>\PQAW.ico
- <Current directory>\Ykci.exe
- <Current directory>\vAoe.exe
- <Current directory>\kEAy.ico
- <Current directory>\HwQE.exe
- <Current directory>\oksK.ico
- <Current directory>\osIw.ico
- <Current directory>\zAcE.exe
- <Current directory>\lgsA.ico
- <Current directory>\Ckgm.exe
- <Current directory>\MscQ.exe
- %TEMP%\lAUEUkAs.bat
- <Current directory>\fIAa.ico
- <Current directory>\AskG.ico
- <Current directory>\Ncom.exe
- <Current directory>\nAwY.ico
- <Current directory>\hgge.exe
- <Current directory>\xQAo.exe
- %TEMP%\NsUkAEkA.bat
- <Current directory>\TkIS.ico
- <Current directory>\mwAi.ico
- <Current directory>\qgoY.exe
- <Current directory>\AQQg.ico
- <Current directory>\IIwy.exe
- <Current directory>\RMIg.ico
- <Current directory>\VsQU.exe
- <Current directory>\SMEy.ico
- <Current directory>\UUIq.exe
- <Current directory>\dYMG.exe
- <Current directory>\zEws.ico
- <Current directory>\zoku.exe
- <Current directory>\VEIK.ico
- <Current directory>\OQcw.ico
- <Current directory>\Pogc.exe
- %TEMP%\dewIocYI.bat
- <Current directory>\ikUe.exe
- %TEMP%\DIsYAEkg.bat
- %TEMP%\TekEkcIY.bat
- <Current directory>\vUIC.ico
- <Current directory>\HQEi.exe
- <Current directory>\UYQa.ico
- <Current directory>\cwwq.exe
- <Current directory>\QsYq.ico
- <Current directory>\PosQ.exe
- <Current directory>\loEE.ico
- <Current directory>\fsoK.exe
- <Current directory>\BYAq.ico
- <Current directory>\DYcw.exe
- <Current directory>\IUsY.ico
- <Current directory>\RAAs.ico
- %TEMP%\JSIwEUgM.bat
- <Current directory>\kkcC.ico
- <Current directory>\oIwk.exe
- <Current directory>\yUcc.exe
- <Current directory>\AIQE.ico
- <Current directory>\GoIA.exe
- <Current directory>\WswI.ico
- <Current directory>\bEcu.ico
- <Current directory>\uEMm.exe
- %TEMP%\tqoYQock.bat
- <Current directory>\VscA.exe
- <Current directory>\rIgu.ico
- <Current directory>\BsQw.exe
- <Current directory>\JQUU.ico
- <Current directory>\OUQM.ico
- <Current directory>\xcog.exe
- <Current directory>\QoAW.ico
- <Current directory>\kYkW.exe
- <Current directory>\DooE.exe
- <Current directory>\TQkW.ico
- %TEMP%\xMUsgYkc.bat
- <Current directory>\NYkE.exe
- <Current directory>\QQQi.ico
- %TEMP%\kMgAAgMc.bat
- <Current directory>\UAQU.ico
- <Current directory>\yQUQ.exe
- <Current directory>\IQQg.ico
- <Current directory>\UIos.exe
- <Current directory>\tUwM.ico
- <Current directory>\lAYY.ico
- <Current directory>\awIk.exe
- <Current directory>\YIwU.ico
- <Current directory>\EgMG.exe
- <Current directory>\jogA.exe
- %TEMP%\uQccYcIA.bat
- <Current directory>\NMke.ico
- <Current directory>\dskS.ico
- %TEMP%\tEMYIEkk.bat
- <Current directory>\egkW.exe
- <Current directory>\WYcw.exe
- <Current directory>\RUIy.exe
- %TEMP%\bsAUMQYE.bat
- <Current directory>\uMcU.ico
- <Current directory>\tgMg.exe
- <Current directory>\cIcu.exe
- <Current directory>\XQIS.ico
- <Current directory>\xUgg.exe
- <Current directory>\hEcE.ico
- <Current directory>\Nkcw.ico
- %TEMP%\LScMoYcs.bat
- <Current directory>\zIgo.exe
- <Current directory>\rocc.ico
- <Current directory>\uYEy.exe
- %TEMP%\tOkwEYos.bat
- <Current directory>\tIIc.exe
- <Current directory>\IYwY.ico
- <Current directory>\HsIu.exe
- <Current directory>\skcM.ico
- <Current directory>\msow.exe
- <Current directory>\tsca.ico
- <Current directory>\JsQa.exe
- <Current directory>\LQIK.ico
- %TEMP%\LUIkcogw.bat
- <Current directory>\wUMm.exe
- <Current directory>\DYwK.ico
- <Current directory>\lAws.exe
- <Current directory>\XwUy.ico
- <Current directory>\DUwI.exe
- <Current directory>\DkcG.ico
- %TEMP%\aCgAgwMY.bat
- <Current directory>\pcEG.exe
- <Current directory>\MooC.ico
- <Current directory>\rwsu.exe
- %TEMP%\USAoYQIk.bat
- %TEMP%\viAsQksQ.bat
- %TEMP%\gSwAAwEE.bat
- %TEMP%\PgYwwgsw.bat
- %TEMP%\eOogEgsM.bat
- %TEMP%\agAksAYc.bat
- %TEMP%\RqEEQIYk.bat
- %TEMP%\NEwEcIsY.bat
- %TEMP%\gCEgQsMY.bat
- %TEMP%\kwIkEcEQ.bat
- %TEMP%\CKoAoQgY.bat
- %TEMP%\iksQUcMg.bat
- %TEMP%\DSsoIMcU.bat
- %TEMP%\acoMogAI.bat
- %TEMP%\gyskUQIY.bat
- <Current directory>\RkQY.ico
- <Current directory>\YgAw.exe
- %TEMP%\PawgwkAE.bat
- <Current directory>\FYko.exe
- <Current directory>\dEYK.ico
- <Current directory>\Ckkg.exe
- <Current directory>\DQYW.ico
- %TEMP%\CuQUwYIg.bat
- %TEMP%\PegswAMs.bat
- %TEMP%\eAkUkMcE.bat
- %TEMP%\VQQMIgwI.bat
- %TEMP%\xmYIEEYI.bat
- %TEMP%\XGkgQQYM.bat
- %TEMP%\cuIoMMMY.bat
- <Current directory>\CAAc.ico
- <Current directory>\dksS.exe
- %TEMP%\vSUQwAsk.bat
- <Current directory>\HccA.exe
- <Current directory>\KMQg.exe
- %TEMP%\icwAgoAw.bat
- <Current directory>\UAwW.ico
- <Current directory>\XwsM.exe
- <Current directory>\cYsY.ico
- <Current directory>\rgki.exe
- <Current directory>\uIcW.ico
- <Current directory>\qEAE.ico
- <Current directory>\GAYW.exe
- %TEMP%\uiowwwcY.bat
- <Current directory>\BQYK.ico
- <Current directory>\sQwM.exe
- <Current directory>\FMMM.ico
- <Current directory>\DEUe.exe
- <Current directory>\KYQi.ico
- <Current directory>\aAQC.ico
- <Current directory>\VUII.exe
- %TEMP%\SMQYoIgo.bat
- <Current directory>\sIUq.exe
- <Current directory>\ngMW.ico
- <Current directory>\yMYw.exe
- <Current directory>\xoAa.ico
- %TEMP%\YuQggEAQ.bat
- <Current directory>\Fkkm.ico
- <Current directory>\TMkW.exe
- <Current directory>\DEAI.ico
- <Current directory>\Wggg.exe
- %TEMP%\WeAYEQcI.bat
- <Current directory>\Fwks.exe
- <Current directory>\SEYy.ico
- <Current directory>\Vkke.exe
- <Current directory>\Coge.ico
- <Current directory>\rcQO.ico
- <Current directory>\yYUg.exe
- <Current directory>\togy.ico
- <Current directory>\QEsw.exe
- <Current directory>\ZYQy.ico
- <Current directory>\EUwI.exe
- <Current directory>\aYgI.ico
- <Current directory>\DkAA.exe
- <Current directory>\okck.exe
- %TEMP%\zEYgYYMs.bat
- <Current directory>\ScgU.ico
- <Current directory>\DAcY.ico
- <Current directory>\OcMK.ico
- %TEMP%\toYUgsEA.bat
- <Current directory>\nwQC.exe
- <Current directory>\wIcM.ico
- <Current directory>\KgIk.exe
- <Current directory>\xkUI.ico
- <Current directory>\uQcc.exe
- <Current directory>\vAIA.exe
- %TEMP%\uEMMgQcM.bat
- <Current directory>\uYYO.ico
- from C:\RCX3D.tmp to <Current directory>\Ykci.exe
- from C:\RCX3E.tmp to <Current directory>\vAoe.exe
- from C:\RCX3C.tmp to <Current directory>\UAYY.exe
- from C:\RCX3A.tmp to <Current directory>\VcIQ.exe
- from C:\RCX3B.tmp to <Current directory>\dcQi.exe
- from C:\RCX3F.tmp to <Current directory>\HwQE.exe
- from C:\RCX43.tmp to <Current directory>\qcAw.exe
- from C:\RCX44.tmp to <Current directory>\NYkE.exe
- from C:\RCX42.tmp to <Current directory>\nkYY.exe
- from C:\RCX40.tmp to <Current directory>\igwo.exe
- from C:\RCX41.tmp to <Current directory>\pkoI.exe
- from C:\RCX32.tmp to <Current directory>\Pogc.exe
- from C:\RCX33.tmp to <Current directory>\IIwy.exe
- from C:\RCX31.tmp to <Current directory>\dYMG.exe
- from C:\RCX2F.tmp to <Current directory>\MscQ.exe
- from C:\RCX30.tmp to <Current directory>\zoku.exe
- from C:\RCX34.tmp to <Current directory>\qgoY.exe
- from C:\RCX38.tmp to <Current directory>\uQMC.exe
- from C:\RCX39.tmp to <Current directory>\sAwK.exe
- from C:\RCX37.tmp to <Current directory>\rkYI.exe
- from C:\RCX35.tmp to <Current directory>\UUIq.exe
- from C:\RCX36.tmp to <Current directory>\VsQU.exe
- from C:\RCX45.tmp to <Current directory>\UIos.exe
- from C:\RCX54.tmp to <Current directory>\cwwq.exe
- from C:\RCX55.tmp to <Current directory>\HQEi.exe
- from C:\RCX53.tmp to <Current directory>\ikUe.exe
- from C:\RCX51.tmp to <Current directory>\fsoK.exe
- from C:\RCX52.tmp to <Current directory>\DYcw.exe
- from C:\RCX56.tmp to <Current directory>\uEMm.exe
- from C:\RCX5A.tmp to <Current directory>\yUcc.exe
- from C:\RCX5B.tmp to <Current directory>\GoIA.exe
- from C:\RCX59.tmp to <Current directory>\oIwk.exe
- from C:\RCX57.tmp to <Current directory>\VscA.exe
- from C:\RCX58.tmp to <Current directory>\BsQw.exe
- from C:\RCX49.tmp to <Current directory>\DooE.exe
- from C:\RCX4A.tmp to <Current directory>\egkW.exe
- from C:\RCX48.tmp to <Current directory>\kYkW.exe
- from C:\RCX46.tmp to <Current directory>\yQUQ.exe
- from C:\RCX47.tmp to <Current directory>\xcog.exe
- from C:\RCX4B.tmp to <Current directory>\WYcw.exe
- from C:\RCX4F.tmp to <Current directory>\jogA.exe
- from C:\RCX50.tmp to <Current directory>\PosQ.exe
- from C:\RCX4E.tmp to <Current directory>\EgMG.exe
- from C:\RCX4C.tmp to <Current directory>\RUIy.exe
- from C:\RCX4D.tmp to <Current directory>\awIk.exe
- from C:\RCX2E.tmp to <Current directory>\Ckgm.exe
- from C:\RCXF.tmp to <Current directory>\lAws.exe
- from C:\RCX10.tmp to <Current directory>\wUMm.exe
- from C:\RCXE.tmp to <Current directory>\JsQa.exe
- from C:\RCXC.tmp to <Current directory>\rwsu.exe
- from C:\RCXD.tmp to <Current directory>\pcEG.exe
- from C:\RCX11.tmp to <Current directory>\yYUg.exe
- from C:\RCX15.tmp to <Current directory>\Fwks.exe
- from C:\RCX16.tmp to <Current directory>\Vkke.exe
- from C:\RCX14.tmp to <Current directory>\Wggg.exe
- from C:\RCX12.tmp to <Current directory>\QEsw.exe
- from C:\RCX13.tmp to <Current directory>\EUwI.exe
- from C:\RCX4.tmp to <Current directory>\uYEy.exe
- from C:\RCX5.tmp to <Current directory>\tIIc.exe
- from C:\RCX3.tmp to <Current directory>\Ckkg.exe
- from C:\RCX1.tmp to <Current directory>\YgAw.exe
- from C:\RCX2.tmp to <Current directory>\FYko.exe
- from C:\RCX6.tmp to <Current directory>\HsIu.exe
- from C:\RCXA.tmp to <Current directory>\msow.exe
- from C:\RCXB.tmp to <Current directory>\DUwI.exe
- from C:\RCX9.tmp to <Current directory>\zIgo.exe
- from C:\RCX7.tmp to <Current directory>\xUgg.exe
- from C:\RCX8.tmp to <Current directory>\cIcu.exe
- from C:\RCX17.tmp to <Current directory>\DkAA.exe
- from C:\RCX26.tmp to <Current directory>\DEUe.exe
- from C:\RCX27.tmp to <Current directory>\sQwM.exe
- from C:\RCX25.tmp to <Current directory>\TMkW.exe
- from C:\RCX23.tmp to <Current directory>\yMYw.exe
- from C:\RCX24.tmp to <Current directory>\sIUq.exe
- from C:\RCX28.tmp to <Current directory>\VUII.exe
- from C:\RCX2C.tmp to <Current directory>\xQAo.exe
- from C:\RCX2D.tmp to <Current directory>\zAcE.exe
- from C:\RCX2B.tmp to <Current directory>\hgge.exe
- from C:\RCX29.tmp to <Current directory>\tgMg.exe
- from C:\RCX2A.tmp to <Current directory>\Ncom.exe
- from C:\RCX1B.tmp to <Current directory>\okck.exe
- from C:\RCX1C.tmp to <Current directory>\nwQC.exe
- from C:\RCX1A.tmp to <Current directory>\vAIA.exe
- from C:\RCX18.tmp to <Current directory>\KgIk.exe
- from C:\RCX19.tmp to <Current directory>\uQcc.exe
- from C:\RCX1D.tmp to <Current directory>\rgki.exe
- from C:\RCX21.tmp to <Current directory>\HccA.exe
- from C:\RCX22.tmp to <Current directory>\KMQg.exe
- from C:\RCX20.tmp to <Current directory>\dksS.exe
- from C:\RCX1E.tmp to <Current directory>\XwsM.exe
- from C:\RCX1F.tmp to <Current directory>\GAYW.exe
- '20#.#19.204.12':666
- '19#.#86.45.170':666
- '74.##5.232.51':80
- '20#.#7.164.69':666
- '20#.#7.164.69':9999
- '20#.#19.204.12':9999
- '19#.#86.45.170':9999
- 74.##5.232.51/
- DNS ASK google.com
- ClassName: 'Indicator' WindowName: ''