Trojan.KeyLogger.26339

Technical Information

Malicious functions:

Installs hooks to intercept notifications

on keystrokes:

Handler for all processes: <Current directory>\cfgdll.dll

Modifies file system :

Creates the following files:

<Current directory>\pic\µЗВЅИ¦.bmp
<Current directory>\pic\µЗВЅИЎПы.bmp
<Current directory>\pic\µЗВЅИ·¶Ё.bmp
<Current directory>\pic\ёєєЕ.bmp
<Current directory>\pic\·ўЛН.bmp
<Current directory>\pic\µ№КэµЪ¶юФ¶.bmp
<Current directory>\pic\ІїВдіеН»9.bmp
<Current directory>\pic\ІїВдіеН»8.bmp
<Current directory>\pic\ІїВдіеН»ДЪїЁ.bmp
<Current directory>\pic\ІжІж.bmp
<Current directory>\pic\ІїВдХЅ»ШУЄ.bmp
<Current directory>\pic\ЅбКшХЅ¶·И·ИП.bmp
<Current directory>\pic\ЅбКшХЅ¶·.bmp
<Current directory>\pic\Ѕш№Ґ.bmp
<Current directory>\pic\ѕи±шmm2.bmp
<Current directory>\pic\ѕи±шmm.bmp
<Current directory>\pic\Ѕ±µДУН.bmp
<Current directory>\pic\»ЖГ«.bmp
<Current directory>\pic\№Ш±Хѕи±шјэН·.bmp
<Current directory>\pic\»ШУЄ.bmp
<Current directory>\pic\Ѕ±µДЛ®.bmp
<Current directory>\pic\Ѕ±µДЅр.bmp
<Current directory>\pic\ІїВдіеН»7.bmp
<Current directory>\pic\±шУЄАп»ЖГ«єЪ.bmp
<Current directory>\pic\±шУЄАп»ЖГ«s1.bmp
<Current directory>\pic\±шУЄАп»ЖГ«єЪs1.bmp
<Current directory>\pic\±шУЄАпЕЦЧУєЪ.bmp
<Current directory>\pic\±шУЄАпЕЦЧУ.bmp
<Current directory>\pic\±шУЄАп»ЖГ«.bmp
<Current directory>\pic\±шУЄАпmm.bmp
<Current directory>\pic\±шУЄµДІжІж.bmp
<Current directory>\pic\±шУЄАпmms1.bmp
<Current directory>\pic\±шУЄАпmmєЪs1.bmp
<Current directory>\pic\±шУЄАпmmєЪ.bmp
<Current directory>\pic\ІїВдіеН»3.bmp
<Current directory>\pic\ІїВдіеН»2.bmp
<Current directory>\pic\ІїВдіеН»4.bmp
<Current directory>\pic\ІїВдіеН»6.bmp
<Current directory>\pic\ІїВдіеН»5.bmp
<Current directory>\pic\ІїВдіеН».bmp
<Current directory>\pic\±шУЄЙБµз.bmp
<Current directory>\pic\±шУЄАпФмїс±©.bmp
<Current directory>\pic\±шУЄТ°Цн.bmp
<Current directory>\pic\±шУЄТСВъ.bmp
<Current directory>\pic\±шУЄТ°ЦнєЪ.bmp
<Current directory>\pic\ѕи±шЛж±гЧЦ.bmp
<Current directory>\pic\ѕи±шКШјТЧЦ.bmp
<Current directory>\pic\ѕи±шЛжТвЧЦ.bmp
<Current directory>\pic\ѕи±шФцФ®ЧЦ.bmp
<Current directory>\pic\ѕи±шФ¶іМЧЦ.bmp
<Current directory>\pic\ѕи±шКЇН·ЧЦ.bmp
<Current directory>\pic\ѕи±шЕ®ОЧЧЦ.bmp
<Current directory>\pic\ѕи±шД¬ИПЧЦ.bmp
<Current directory>\pic\ѕи±шЕЦЧУ.bmp
<Current directory>\pic\ѕи±шЗтЧЦ.bmp
<Current directory>\pic\ѕи±шЕЦЧЦ.bmp
<Current directory>\pic\ВъЛ®1.bmp
<Current directory>\pic\БнТ»Йи±ё2.bmp
<Current directory>\pic\ВъЛ®2.bmp
<Current directory>\pic\ВъЛ®4.bmp
<Current directory>\pic\ВъЛ®3.bmp
<Current directory>\pic\БнТ»ёцЙи±ё.bmp
<Current directory>\pic\ѕи±шЦнЧЦ.bmp
<Current directory>\pic\ѕи±шФцФ®ЧЦ2.bmp
<Current directory>\pic\їЄ¶ЬИ·¶Ё.bmp
<Current directory>\pic\їс±©Т©Л®.bmp
<Current directory>\pic\їїЖЧ±кЗ©.bmp
<Current directory>\pic\ѕи±шГГГГЧЦ.bmp
<Current directory>\pic\ѕи±шґуMMЧЦ.bmp
<Current directory>\pic\ѕи±шІїВдХЅЧЦ.bmp
<Current directory>\pic\ѕи±шµДІж.bmp
<Current directory>\pic\ѕи±ш·ЁЧЦ.bmp
<Current directory>\pic\ѕи±шµДІж2.bmp
<Current directory>\pic\ѕи±шMMЧЦ4.bmp
<Current directory>\pic\ѕи±шmm4.bmp
<Current directory>\pic\ѕи±шmm3.bmp
<Current directory>\pic\ѕи±шmmЧЦ.bmp
<Current directory>\pic\ѕи±шmmЧЦ3.bmp
<Current directory>\pic\ѕи±шmmЧЦ2.bmp
<Current directory>\pic\ѕи±шѕЮЧЦ.bmp
<Current directory>\pic\ѕи±шѕИГьЧЦ.bmp
<Current directory>\pic\ѕи±шїґјТЧЦ.bmp
<Current directory>\pic\ѕи±шБъЧЦ.bmp
<Current directory>\pic\ѕи±шїХѕьЧЦ.bmp
<Current directory>\pic\ѕи±ш»ЖГ«.bmp
<Current directory>\pic\ѕи±ш·±МеД¬ИПЧЦ.bmp
<Current directory>\pic\ѕи±ш·±МеБъЧЦ.bmp
<Current directory>\pic\ѕи±ш·±МеЗтЧЦ.bmp
<Current directory>\pic\ѕи±ш№ЧЦ.bmp
<Current directory>\pic\ѕи±ш·±МеЦнЧЦ.bmp
<Current directory>\pic\±шУЄІФУ¬єЪ.bmp
<Current directory>\pic\l3028.bmp
<Current directory>\pic\l3027.bmp
<Current directory>\pic\l3029.bmp
<Current directory>\pic\l3031.bmp
<Current directory>\pic\l3030.bmp
<Current directory>\pic\l3026.bmp
<Current directory>\pic\l3022.bmp
<Current directory>\pic\l3021.bmp
<Current directory>\pic\l3023.bmp
<Current directory>\pic\l3025.bmp
<Current directory>\pic\l3024.bmp
<Current directory>\pic\l4002.bmp
<Current directory>\pic\l4001.bmp
<Current directory>\pic\l4003.bmp
<Current directory>\pic\l4005.bmp
<Current directory>\pic\l4004.bmp
<Current directory>\pic\l3037.bmp
<Current directory>\pic\l3033.bmp
<Current directory>\pic\l3032.bmp
<Current directory>\pic\l3034.bmp
<Current directory>\pic\l3036.bmp
<Current directory>\pic\l3035.bmp
<Current directory>\pic\l3020.bmp
<Current directory>\pic\l3005.bmp
<Current directory>\pic\l3004.bmp
<Current directory>\pic\l3006.bmp
<Current directory>\pic\l3008.bmp
<Current directory>\pic\l3007.bmp
<Current directory>\pic\l3003.bmp
<Current directory>\pic\l2041.bmp
<Current directory>\pic\l2039.bmp
<Current directory>\pic\l2042.bmp
<Current directory>\pic\l3002.bmp
<Current directory>\pic\l3001.bmp
<Current directory>\pic\l3016.bmp
<Current directory>\pic\l3015.bmp
<Current directory>\pic\l3017.bmp
<Current directory>\pic\l3019.bmp
<Current directory>\pic\l3018.bmp
<Current directory>\pic\l3014.bmp
<Current directory>\pic\l3010.bmp
<Current directory>\pic\l3009.bmp
<Current directory>\pic\l3011.bmp
<Current directory>\pic\l3013.bmp
<Current directory>\pic\l3012.bmp
<Current directory>\pic\l4036.bmp
<Current directory>\pic\l4035.bmp
<Current directory>\pic\l4037.bmp
<Current directory>\pic\l4039.bmp
<Current directory>\pic\l4038.bmp
<Current directory>\pic\l4034.bmp
<Current directory>\pic\l4030.bmp
<Current directory>\pic\l4029.bmp
<Current directory>\pic\l4031.bmp
<Current directory>\pic\l4033.bmp
<Current directory>\pic\l4032.bmp
<Current directory>\pic\z3.bmp
<Current directory>\pic\z2.bmp
<Current directory>\pic\z4.bmp
<Current directory>\pic\±шУЄІФУ¬.bmp
<Current directory>\pic\z5.bmp
<Current directory>\pic\RegDll.dll
<Current directory>\pic\l4041.bmp
<Current directory>\pic\l4040.bmp
<Current directory>\pic\l4042.bmp
<Current directory>\pic\mm.bmp
<Current directory>\pic\l4043.bmp
<Current directory>\pic\l4028.bmp
<Current directory>\pic\l4013.bmp
<Current directory>\pic\l4012.bmp
<Current directory>\pic\l4014.bmp
<Current directory>\pic\l4016.bmp
<Current directory>\pic\l4015.bmp
<Current directory>\pic\l4011.bmp
<Current directory>\pic\l4007.bmp
<Current directory>\pic\l4006.bmp
<Current directory>\pic\l4008.bmp
<Current directory>\pic\l4010.bmp
<Current directory>\pic\l4009.bmp
<Current directory>\pic\l4024.bmp
<Current directory>\pic\l4023.bmp
<Current directory>\pic\l4025.bmp
<Current directory>\pic\l4027.bmp
<Current directory>\pic\l4026.bmp
<Current directory>\pic\l4022.bmp
<Current directory>\pic\l4018.bmp
<Current directory>\pic\l4017.bmp
<Current directory>\pic\l4019.bmp
<Current directory>\pic\l4021.bmp
<Current directory>\pic\l4020.bmp
<Current directory>\pic\ВъЛ®5.bmp
<Current directory>\pic\З®1s54.bmp
<Current directory>\pic\З®1s53.bmp
<Current directory>\pic\З®1s55.bmp
<Current directory>\pic\З®1s57.bmp
<Current directory>\pic\З®1s56.bmp
<Current directory>\pic\З®1s52.bmp
<Current directory>\pic\З®1s48.bmp
<Current directory>\pic\З®1s47.bmp
<Current directory>\pic\З®1s49.bmp
<Current directory>\pic\З®1s51.bmp
<Current directory>\pic\З®1s50.bmp
<Current directory>\pic\З®1s65.bmp
<Current directory>\pic\З®1s64.bmp
<Current directory>\pic\З®1s66.bmp
<Current directory>\pic\З®12.bmp
<Current directory>\pic\З®11.bmp
<Current directory>\pic\З®1s63.bmp
<Current directory>\pic\З®1s59.bmp
<Current directory>\pic\З®1s58.bmp
<Current directory>\pic\З®1s60.bmp
<Current directory>\pic\З®1s62.bmp
<Current directory>\pic\З®1s61.bmp
<Current directory>\pic\З®1s46.bmp
<Current directory>\pic\З®1s31.bmp
<Current directory>\pic\З®1s30.bmp
<Current directory>\pic\З®1s32.bmp
<Current directory>\pic\З®1s34.bmp
<Current directory>\pic\З®1s33.bmp
<Current directory>\pic\З®1s29.bmp
<Current directory>\pic\З®1s25.bmp
<Current directory>\pic\З®1s24.bmp
<Current directory>\pic\З®1s26.bmp
<Current directory>\pic\З®1s28.bmp
<Current directory>\pic\З®1s27.bmp
<Current directory>\pic\З®1s42.bmp
<Current directory>\pic\З®1s41.bmp
<Current directory>\pic\З®1s43.bmp
<Current directory>\pic\З®1s45.bmp
<Current directory>\pic\З®1s44.bmp
<Current directory>\pic\З®1s40.bmp
<Current directory>\pic\З®1s36.bmp
<Current directory>\pic\З®1s35.bmp
<Current directory>\pic\З®1s37.bmp
<Current directory>\pic\З®1s39.bmp
<Current directory>\pic\З®1s38.bmp
<Current directory>\pic\З®133.bmp
<Current directory>\pic\З®132.bmp
<Current directory>\pic\З®134.bmp
<Current directory>\pic\З®136.bmp
<Current directory>\pic\З®135.bmp
<Current directory>\pic\З®131.bmp
<Current directory>\pic\З®127.bmp
<Current directory>\pic\З®126.bmp
<Current directory>\pic\З®128.bmp
<Current directory>\pic\З®130.bmp
<Current directory>\pic\З®129.bmp
<Current directory>\pic\З®144.bmp
<Current directory>\pic\З®143.bmp
<Current directory>\pic\З®145.bmp
<Current directory>\pic\З®147.bmp
<Current directory>\pic\З®146.bmp
<Current directory>\pic\З®142.bmp
<Current directory>\pic\З®138.bmp
<Current directory>\pic\З®137.bmp
<Current directory>\pic\З®139.bmp
<Current directory>\pic\З®141.bmp
<Current directory>\pic\З®140.bmp
<Current directory>\pic\З®125.bmp
<Current directory>\pic\З®110.bmp
<Current directory>\pic\З®19.bmp
<Current directory>\pic\З®111.bmp
<Current directory>\pic\З®113.bmp
<Current directory>\pic\З®112.bmp
<Current directory>\pic\З®18.bmp
<Current directory>\pic\З®14.bmp
<Current directory>\pic\З®13.bmp
<Current directory>\pic\З®15.bmp
<Current directory>\pic\З®17.bmp
<Current directory>\pic\З®16.bmp
<Current directory>\pic\З®121.bmp
<Current directory>\pic\З®120.bmp
<Current directory>\pic\З®122.bmp
<Current directory>\pic\З®124.bmp
<Current directory>\pic\З®123.bmp
<Current directory>\pic\З®119.bmp
<Current directory>\pic\З®115.bmp
<Current directory>\pic\З®114.bmp
<Current directory>\pic\З®116.bmp
<Current directory>\pic\З®118.bmp
<Current directory>\pic\З®117.bmp
<Current directory>\pic\З®1s23.bmp
<Current directory>\pic\ВъЛ®36.bmp
<Current directory>\pic\ВъЛ®35.bmp
<Current directory>\pic\ВъЛ®37.bmp
<Current directory>\pic\ВъЛ®39.bmp
<Current directory>\pic\ВъЛ®38.bmp
<Current directory>\pic\ВъЛ®34.bmp
<Current directory>\pic\ВъЛ®30.bmp
<Current directory>\pic\ВъЛ®29.bmp
<Current directory>\pic\ВъЛ®31.bmp
<Current directory>\pic\ВъЛ®33.bmp
<Current directory>\pic\ВъЛ®32.bmp
<Current directory>\pic\ВъЛ®47.bmp
<Current directory>\pic\ВъЛ®46.bmp
<Current directory>\pic\ВъЛ®48.bmp
<Current directory>\pic\ВъЛ®50.bmp
<Current directory>\pic\ВъЛ®49.bmp
<Current directory>\pic\ВъЛ®45.bmp
<Current directory>\pic\ВъЛ®41.bmp
<Current directory>\pic\ВъЛ®40.bmp
<Current directory>\pic\ВъЛ®42.bmp
<Current directory>\pic\ВъЛ®44.bmp
<Current directory>\pic\ВъЛ®43.bmp
<Current directory>\pic\ВъЛ®28.bmp
<Current directory>\pic\ВъЛ®13.bmp
<Current directory>\pic\ВъЛ®12.bmp
<Current directory>\pic\ВъЛ®14.bmp
<Current directory>\pic\ВъЛ®16.bmp
<Current directory>\pic\ВъЛ®15.bmp
<Current directory>\pic\ВъЛ®11.bmp
<Current directory>\pic\ВъЛ®7.bmp
<Current directory>\pic\ВъЛ®6.bmp
<Current directory>\pic\ВъЛ®8.bmp
<Current directory>\pic\ВъЛ®10.bmp
<Current directory>\pic\ВъЛ®9.bmp
<Current directory>\pic\ВъЛ®24.bmp
<Current directory>\pic\ВъЛ®23.bmp
<Current directory>\pic\ВъЛ®25.bmp
<Current directory>\pic\ВъЛ®27.bmp
<Current directory>\pic\ВъЛ®26.bmp
<Current directory>\pic\ВъЛ®22.bmp
<Current directory>\pic\ВъЛ®18.bmp
<Current directory>\pic\ВъЛ®17.bmp
<Current directory>\pic\ВъЛ®19.bmp
<Current directory>\pic\ВъЛ®21.bmp
<Current directory>\pic\ВъЛ®20.bmp
<Current directory>\pic\З®1s8.bmp
<Current directory>\pic\З®1s7.bmp
<Current directory>\pic\З®1s9.bmp
<Current directory>\pic\З®1s11.bmp
<Current directory>\pic\З®1s10.bmp
<Current directory>\pic\З®1s6.bmp
<Current directory>\pic\З®1s2.bmp
<Current directory>\pic\З®1s1.bmp
<Current directory>\pic\З®1s3.bmp
<Current directory>\pic\З®1s5.bmp
<Current directory>\pic\З®1s4.bmp
<Current directory>\pic\З®1s19.bmp
<Current directory>\pic\З®1s18.bmp
<Current directory>\pic\З®1s20.bmp
<Current directory>\pic\З®1s22.bmp
<Current directory>\pic\З®1s21.bmp
<Current directory>\pic\З®1s17.bmp
<Current directory>\pic\З®1s13.bmp
<Current directory>\pic\З®1s12.bmp
<Current directory>\pic\З®1s14.bmp
<Current directory>\pic\З®1s16.bmp
<Current directory>\pic\З®1s15.bmp
<Current directory>\pic\З®1.bmp
<Current directory>\pic\ДЈДвЖчНј±к.bmp
<Current directory>\pic\ВъЛ®s6.bmp
<Current directory>\pic\ДЪХю±шУЄ.bmp
<Current directory>\pic\ДЪХю±шУЄР±ёЬ.bmp
<Current directory>\pic\ДЪХю±шУЄїХ°Ч.bmp
<Current directory>\pic\ВъЛ®s5.bmp
<Current directory>\pic\ВъЛ®52.bmp
<Current directory>\pic\ВъЛ®51.bmp
<Current directory>\pic\ВъЛ®s1.bmp
<Current directory>\pic\ВъЛ®s3.bmp
<Current directory>\pic\ВъЛ®s2.bmp
<Current directory>\pic\ДЪХюБДМміцАґ.bmp
<Current directory>\pic\ДЪХюјхєЕ2.bmp
<Current directory>\pic\ДЪХюБДМмјэН·.bmp
<Current directory>\pic\ЕЦЧУ.bmp
<Current directory>\pic\ДЪХюМбЛЩ.bmp
<Current directory>\pic\ДЪХюјхєЕ.bmp
<Current directory>\pic\ДЪХюІїВдіЗ±¤30.bmp
<Current directory>\pic\ДЪХюІїВдіЗ±¤.bmp
<Current directory>\pic\ДЪХюІїВдіЗ±¤Чу.bmp
<Current directory>\pic\ДЪХю№єВт.bmp
<Current directory>\pic\ДЪХюІїВдНј±к.bmp
<Current directory>\pic\d1026.bmp
<Current directory>\pic\d1025.bmp
<Current directory>\pic\d1027.bmp
<Current directory>\pic\d1029.bmp
<Current directory>\pic\d1028.bmp
<Current directory>\pic\d1024.bmp
<Current directory>\pic\d1020.bmp
<Current directory>\pic\d1019.bmp
<Current directory>\pic\d1021.bmp
<Current directory>\pic\d1023.bmp
<Current directory>\pic\d1022.bmp
<Current directory>\pic\d2007.bmp
<Current directory>\pic\d2006.bmp
<Current directory>\pic\d2009.bmp
<Current directory>\pic\d2011.bmp
<Current directory>\pic\d2010.bmp
<Current directory>\pic\d2005.bmp
<Current directory>\pic\d2001.bmp
<Current directory>\pic\d1030.bmp
<Current directory>\pic\d2002.bmp
<Current directory>\pic\d2004.bmp
<Current directory>\pic\d2003.bmp
<Current directory>\pic\d1018.bmp
<Current directory>\pic\d1003.bmp
<Current directory>\pic\d1002.bmp
<Current directory>\pic\d1004.bmp
<Current directory>\pic\d1006.bmp
<Current directory>\pic\d1005.bmp
<Current directory>\pic\d1001.bmp
<Current directory>\pic\c3.bmp
<Current directory>\pic\c2.bmp
<Current directory>\pic\c4.bmp
<Current directory>\pic\d.bmp
<Current directory>\pic\c5.bmp
<Current directory>\pic\d1014.bmp
<Current directory>\pic\d1013.bmp
<Current directory>\pic\d1015.bmp
<Current directory>\pic\d1017.bmp
<Current directory>\pic\d1016.bmp
<Current directory>\pic\d1012.bmp
<Current directory>\pic\d1008.bmp
<Current directory>\pic\d1007.bmp
<Current directory>\pic\d1009.bmp
<Current directory>\pic\d1011.bmp
<Current directory>\pic\d1010.bmp
<Current directory>\pic\d3006.bmp
<Current directory>\pic\d3005.bmp
<Current directory>\pic\d3007.bmp
<Current directory>\pic\d3009.bmp
<Current directory>\pic\d3008.bmp
<Current directory>\pic\d3004.bmp
<Current directory>\pic\d2036.bmp
<Current directory>\pic\d2035.bmp
<Current directory>\pic\d3001.bmp
<Current directory>\pic\d3003.bmp
<Current directory>\pic\d3002.bmp
<Current directory>\pic\d3017.bmp
<Current directory>\pic\d3016.bmp
<Current directory>\pic\d3018.bmp
<Current directory>\pic\d3020.bmp
<Current directory>\pic\d3019.bmp
<Current directory>\pic\d3015.bmp
<Current directory>\pic\d3011.bmp
<Current directory>\pic\d3010.bmp
<Current directory>\pic\d3012.bmp
<Current directory>\pic\d3014.bmp
<Current directory>\pic\d3013.bmp
<Current directory>\pic\d2034.bmp
<Current directory>\pic\d2019.bmp
<Current directory>\pic\d2018.bmp
<Current directory>\pic\d2020.bmp
<Current directory>\pic\d2022.bmp
<Current directory>\pic\d2021.bmp
<Current directory>\pic\d2017.bmp
<Current directory>\pic\d2013.bmp
<Current directory>\pic\d2012.bmp
<Current directory>\pic\d2014.bmp
<Current directory>\pic\d2016.bmp
<Current directory>\pic\d2015.bmp
<Current directory>\pic\d2030.bmp
<Current directory>\pic\d2029.bmp
<Current directory>\pic\d2031.bmp
<Current directory>\pic\d2033.bmp
<Current directory>\pic\d2032.bmp
<Current directory>\pic\d2028.bmp
<Current directory>\pic\d2024.bmp
<Current directory>\pic\d2023.bmp
<Current directory>\pic\d2025.bmp
<Current directory>\pic\d2027.bmp
<Current directory>\pic\d2026.bmp
<Current directory>\pic\c1.bmp
<Current directory>\checkbox_unchecked.ico
<Current directory>\checkbox_checked.ico
<Current directory>\checkbox_disabled_checked.ico
%APPDATA%\qmacro\shield\SD000.dat
<Current directory>\checkbox_disabled_unchecked.ico
<Current directory>\timer_icon.ico
<Current directory>\plugin\WEB.ini
<Current directory>\plugin\SYS.ini
<Current directory>\plugin\WINDOW.ini
%TEMP%\4484.tmp
<Current directory>\plugin\WM.ini
<Current directory>\pic\10ј¶±шУЄЅЈ.bmp
<Current directory>\pic\10ј¶±шУЄ.bmp
<Current directory>\pic\10ј¶±шУЄЅЈ2.bmp
<Current directory>\pic\12ј¶ВъЛ®ІЙјЇ2.bmp
<Current directory>\pic\12ј¶ВъЛ®ІЙјЇ.bmp
<Current directory>\pic\3ёц0ЦРјд.bmp
%APPDATA%\qmacro\shield\SD002.dat
%APPDATA%\qmacro\shield\SD001.dat
%APPDATA%\qmacro\shield\SD003.dat
%APPDATA%\qmacro\shield\Shield.ini
%APPDATA%\qmacro\shield\SD004.dat
<Current directory>\plugin\GETSYSINFO.ini
%TEMP%\mac3.tmp
%TEMP%\mac2.tmp
%TEMP%\plugin.zip
<Current directory>\plugin\SYS.DLL
%TEMP%\adcon\mm\liveupdate8.dat.tmp
%TEMP%\mac1.tmp
%TEMP%\adcon\mm\tmpad.xml
%TEMP%\ad-mymacro9.xml
<Current directory>\cfgdll.dll
%APPDATA%\mymacro\qdisp.dll
<Current directory>\ShieldModule.dat
<Current directory>\plugin\FILE.DLL
<Current directory>\plugin\GETSYSINFO.DLL
%TEMP%\mymacro.zip
<Current directory>\plugin\FILE.ini
<Current directory>\plugin\ENCRYPT.ini
<Current directory>\plugin\WEB.DLL
<Current directory>\plugin\PIAO_SOFT.DLL
<Current directory>\plugin\REGDLL.DLL
<Current directory>\plugin\WINDOW.DLL
<Current directory>\plugin\WM.DLL
<Current directory>\plugin\ENCRYPT.DLL
<Current directory>\pic\bxy9.bmp
<Current directory>\pic\bxy8.bmp
<Current directory>\pic\bxy10.bmp
<Current directory>\pic\bxz2.bmp
<Current directory>\pic\bxz1.bmp
<Current directory>\pic\bxy7.bmp
<Current directory>\pic\bxy3.bmp
<Current directory>\pic\bxy2.bmp
<Current directory>\pic\bxy4.bmp
<Current directory>\pic\bxy6.bmp
<Current directory>\pic\bxy5.bmp
<Current directory>\pic\bxz10.bmp
<Current directory>\pic\bxz9.bmp
<Current directory>\pic\bxz11.bmp
<Current directory>\pic\bxz13.bmp
<Current directory>\pic\bxz12.bmp
<Current directory>\pic\bxz8.bmp
<Current directory>\pic\bxz4.bmp
<Current directory>\pic\bxz3.bmp
<Current directory>\pic\bxz5.bmp
<Current directory>\pic\bxz7.bmp
<Current directory>\pic\bxz6.bmp
<Current directory>\pic\bxy1.bmp
<Current directory>\pic\100НтЛ®ЦРјд.bmp
<Current directory>\pic\100НтЛ®.bmp
<Current directory>\pic\300НтЅр.bmp
<Current directory>\pic\300НтЛ®.bmp
<Current directory>\pic\300НтЅрЦРјд.bmp
<Current directory>\pic\100НтЅрЦРјд.bmp
<Current directory>\pic\20НтЅрЦРјд.bmp
<Current directory>\pic\20НтЅр.bmp
<Current directory>\pic\50НтЅр.bmp
<Current directory>\pic\100НтЅр.bmp
<Current directory>\pic\50НтЅрЦРјд.bmp
<Current directory>\pic\bxc5.bmp
<Current directory>\pic\bxc4.bmp
<Current directory>\pic\bxc6.bmp
<Current directory>\pic\bxc8.bmp
<Current directory>\pic\bxc7.bmp
<Current directory>\pic\bxc3.bmp
<Current directory>\pic\b005.bmp
<Current directory>\pic\300НтЛ®ЦРјд.bmp
<Current directory>\pic\beta±кЗ©.bmp
<Current directory>\pic\bxc2.bmp
<Current directory>\pic\bxc1.bmp
<Current directory>\pic\d3021.bmp
<Current directory>\pic\l1052.bmp
<Current directory>\pic\l1051.bmp
<Current directory>\pic\l1053.bmp
<Current directory>\pic\l1055.bmp
<Current directory>\pic\l1054.bmp
<Current directory>\pic\l1050.bmp
<Current directory>\pic\l1046.bmp
<Current directory>\pic\l1045.bmp
<Current directory>\pic\l1047.bmp
<Current directory>\pic\l1049.bmp
<Current directory>\pic\l1048.bmp
<Current directory>\pic\l1063.bmp
<Current directory>\pic\l1062.bmp
<Current directory>\pic\l1064.bmp
<Current directory>\pic\l1066.bmp
<Current directory>\pic\l1065.bmp
<Current directory>\pic\l1061.bmp
<Current directory>\pic\l1057.bmp
<Current directory>\pic\l1056.bmp
<Current directory>\pic\l1058.bmp
<Current directory>\pic\l1060.bmp
<Current directory>\pic\l1059.bmp
<Current directory>\pic\l1044.bmp
<Current directory>\pic\l1029.bmp
<Current directory>\pic\l1028.bmp
<Current directory>\pic\l1030.bmp
<Current directory>\pic\l1032.bmp
<Current directory>\pic\l1031.bmp
<Current directory>\pic\l1027.bmp
<Current directory>\pic\l1023.bmp
<Current directory>\pic\l1022.bmp
<Current directory>\pic\l1024.bmp
<Current directory>\pic\l1026.bmp
<Current directory>\pic\l1025.bmp
<Current directory>\pic\l1040.bmp
<Current directory>\pic\l1039.bmp
<Current directory>\pic\l1041.bmp
<Current directory>\pic\l1043.bmp
<Current directory>\pic\l1042.bmp
<Current directory>\pic\l1038.bmp
<Current directory>\pic\l1034.bmp
<Current directory>\pic\l1033.bmp
<Current directory>\pic\l1035.bmp
<Current directory>\pic\l1037.bmp
<Current directory>\pic\l1036.bmp
<Current directory>\pic\l2023.bmp
<Current directory>\pic\l2022.bmp
<Current directory>\pic\l2024.bmp
<Current directory>\pic\l2026.bmp
<Current directory>\pic\l2025.bmp
<Current directory>\pic\l2021.bmp
<Current directory>\pic\l2017.bmp
<Current directory>\pic\l2016.bmp
<Current directory>\pic\l2018.bmp
<Current directory>\pic\l2020.bmp
<Current directory>\pic\l2019.bmp
<Current directory>\pic\l2035.bmp
<Current directory>\pic\l2034.bmp
<Current directory>\pic\l2036.bmp
<Current directory>\pic\l2038.bmp
<Current directory>\pic\l2037.bmp
<Current directory>\pic\l2033.bmp
<Current directory>\pic\l2028.bmp
<Current directory>\pic\l2027.bmp
<Current directory>\pic\l2029.bmp
<Current directory>\pic\l2032.bmp
<Current directory>\pic\l2030.bmp
<Current directory>\pic\l2015.bmp
<Current directory>\pic\l1074.bmp
<Current directory>\pic\l1073.bmp
<Current directory>\pic\l1075.bmp
<Current directory>\pic\l2002.bmp
<Current directory>\pic\l2001.bmp
<Current directory>\pic\l1072.bmp
<Current directory>\pic\l1068.bmp
<Current directory>\pic\l1067.bmp
<Current directory>\pic\l1069.bmp
<Current directory>\pic\l1071.bmp
<Current directory>\pic\l1070.bmp
<Current directory>\pic\l2010.bmp
<Current directory>\pic\l2009.bmp
<Current directory>\pic\l2011.bmp
<Current directory>\pic\l2014.bmp
<Current directory>\pic\l2013.bmp
<Current directory>\pic\l2008.bmp
<Current directory>\pic\l2004.bmp
<Current directory>\pic\l2003.bmp
<Current directory>\pic\l2005.bmp
<Current directory>\pic\l2007.bmp
<Current directory>\pic\l2006.bmp
<Current directory>\pic\l1021.bmp
<Current directory>\pic\d3052.bmp
<Current directory>\pic\d3051.bmp
<Current directory>\pic\d3053.bmp
<Current directory>\pic\d3055.bmp
<Current directory>\pic\d3054.bmp
<Current directory>\pic\d3050.bmp
<Current directory>\pic\d3046.bmp
<Current directory>\pic\d3045.bmp
<Current directory>\pic\d3047.bmp
<Current directory>\pic\d3049.bmp
<Current directory>\pic\d3048.bmp
<Current directory>\pic\dm.dll
<Current directory>\pic\d3062.bmp
<Current directory>\pic\fq1.bmp
<Current directory>\pic\fq3.bmp
<Current directory>\pic\fq2.bmp
<Current directory>\pic\d3061.bmp
<Current directory>\pic\d3057.bmp
<Current directory>\pic\d3056.bmp
<Current directory>\pic\d3058.bmp
<Current directory>\pic\d3060.bmp
<Current directory>\pic\d3059.bmp
<Current directory>\pic\d3044.bmp
<Current directory>\pic\d3029.bmp
<Current directory>\pic\d3028.bmp
<Current directory>\pic\d3030.bmp
<Current directory>\pic\d3032.bmp
<Current directory>\pic\d3031.bmp
<Current directory>\pic\d3027.bmp
<Current directory>\pic\d3023.bmp
<Current directory>\pic\d3022.bmp
<Current directory>\pic\d3024.bmp
<Current directory>\pic\d3026.bmp
<Current directory>\pic\d3025.bmp
<Current directory>\pic\d3040.bmp
<Current directory>\pic\d3039.bmp
<Current directory>\pic\d3041.bmp
<Current directory>\pic\d3043.bmp
<Current directory>\pic\d3042.bmp
<Current directory>\pic\d3038.bmp
<Current directory>\pic\d3034.bmp
<Current directory>\pic\d3033.bmp
<Current directory>\pic\d3035.bmp
<Current directory>\pic\d3037.bmp
<Current directory>\pic\d3036.bmp
<Current directory>\pic\l1006.bmp
<Current directory>\pic\l1005.bmp
<Current directory>\pic\l1007.bmp
<Current directory>\pic\l1009.bmp
<Current directory>\pic\l1008.bmp
<Current directory>\pic\l1004.bmp
<Current directory>\pic\l1s7.bmp
<Current directory>\pic\l1s6.bmp
<Current directory>\pic\l1001.bmp
<Current directory>\pic\l1003.bmp
<Current directory>\pic\l1002.bmp
<Current directory>\pic\l1017.bmp
<Current directory>\pic\l1016.bmp
<Current directory>\pic\l1018.bmp
<Current directory>\pic\l1020.bmp
<Current directory>\pic\l1019.bmp
<Current directory>\pic\l1015.bmp
<Current directory>\pic\l1011.bmp
<Current directory>\pic\l1010.bmp
<Current directory>\pic\l1012.bmp
<Current directory>\pic\l1014.bmp
<Current directory>\pic\l1013.bmp
<Current directory>\pic\l1s5.bmp
<Current directory>\pic\h1.bmp
<Current directory>\pic\fq10.bmp
<Current directory>\pic\h2.bmp
<Current directory>\pic\h4.bmp
<Current directory>\pic\h3.bmp
<Current directory>\pic\fq9.bmp
<Current directory>\pic\fq5.bmp
<Current directory>\pic\fq4.bmp
<Current directory>\pic\fq6.bmp
<Current directory>\pic\fq8.bmp
<Current directory>\pic\fq7.bmp
<Current directory>\pic\l1s1.bmp
<Current directory>\pic\j3.bmp
<Current directory>\pic\l1s2.bmp
<Current directory>\pic\l1s4.bmp
<Current directory>\pic\l1s3.bmp
<Current directory>\pic\j2.bmp
<Current directory>\pic\h6.bmp
<Current directory>\pic\h5.bmp
<Current directory>\pic\h7.bmp
<Current directory>\pic\j1.bmp
<Current directory>\pic\home.bmp

Deletes the following files:

<Current directory>\checkbox_disabled_checked.ico
<Current directory>\checkbox_unchecked.ico
<Current directory>\ShieldModule.dat
<Current directory>\checkbox_disabled_unchecked.ico
<Current directory>\checkbox_checked.ico
%TEMP%\plugin.zip
%TEMP%\adcon\mm\tmpad.xml
<Current directory>\timer_icon.ico
%TEMP%\mymacro.zip

Moves the following files:

from %TEMP%\ad-mymacro9.xml.tmp to %TEMP%\ad-mymacro9.xml
from %TEMP%\adcon\mm\liveupdate8.dat.tmp to %TEMP%\adcon\mm\liveupdate8.dat

Network activity:

Connects to:

'so##.anjian.com':80
'do##.#rbrothers.com':80
'localhost':1039

TCP:

HTTP GET requests:

so##.anjian.com/V2014V2/Config/ad-mymacro.xml
do##.#rbrothers.com/qmacro/up_mymacro/liveupdate8.dat

UDP:

DNS ASK so##.anjian.com
DNS ASK do##.#rbrothers.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial