Trojan.DownLoader17.962

Technical Information

Malicious functions:

Creates and executes the following:

'%APPDATA%\4f41222c438c431407ce877bd5ab9228\crossfire.exe'
'%TEMP%\4C0A.tmp\hei.exe'
'%TEMP%\4C0A.tmp\ChdXC.exe'

Searches for windows to

detect analytical utilities:

ClassName: 'pediy06' WindowName: ''
ClassName: 'GBDYLLO' WindowName: ''
ClassName: 'OLLYDBG' WindowName: ''

Modifies file system :

Creates the following files:

%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(ґЯЙЅ)-ЙЅФАµШґш2.txt
%TEMP%\4C0A.tmp\Script\КЁЙнИЛё±±ѕ\ЅрЧЦЛю РьКТ 4.txt
%TEMP%\4C0A.tmp\Script\КЁЙнИЛё±±ѕ\ЅрЧЦЛю РьКТ 3.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(ОЧЕ®)їЛ¶ЕїЁµДРДФа.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(їЙ°®)-ЙЅФАµШґш3.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(їЙЕВ)-ТхЙЧЎХ¬6.txt
%TEMP%\4C0A.tmp\Script\КЁЙнИЛё±±ѕ\·вУЎµДЕ®НхКТ.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\јвЅРС©µШ.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\·вУЎµДЕ®НхКТ[ЙЯЕ®].txt
%TEMP%\4C0A.tmp\Script\КЁЙнИЛё±±ѕ\ЅрЧЦЛю РьКТ 2.txt
%TEMP%\4C0A.tmp\Script\КЁЙнИЛё±±ѕ\ЅрЧЦЛю РьКТ 1.txt
%TEMP%\4C0A.tmp\Script\КЁЙнИЛё±±ѕ\КЁЙнИЛГжПс·їјд.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(»ўЅд)-°Ў¶ыїЁµЫСЗ5.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(»ЁХИ)-єЪ°µґФБЦ6.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(°Е±И)-ґФБЦµШґш5.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(С©№)-јвЅРС©µШ.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(С©Е®)-јвЅРС©µШ1Ўў2Іг.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(тщтр)-µШПВ¶ґСЁ.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(ОдЖч)-ЙоФЁ8.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(УЈ»Ё)-УЈ»Ёєю7.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(ИМХЯ·Йµ¶)єЪФВіЗјаУь.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(ВМБъ)-їЛ¶ЕїЁТЕЦ·3ХэКЅ.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(АЗГ¬)-№ЕґФБЦДЪІї.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(°®№)-ЙіД®µШґш8.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\їЛ¶ЕїЁТЕЦ·3ЈЁВМБъЈ©ХэКЅ.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\µНТфС©µШЈЁВмТПЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\ИЛУгИ«Нј.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\№ЕДѕґФБЦіцїЪЈЁЦнЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\№ЕДѕґФБЦДЪІїЈЁаЫ&АЗЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\№ЕґФБЦДЪІїЈЁАЗГ¬Ј©ХэКЅ.txt
%TEMP%\4C0A.tmp\Script\¶·КЮіЎ\¶·КЮіЎёЯј¶ЎЈ.txt
%TEMP%\4C0A.tmp\Script\¶·КЮіЎ\¶·КЮіЎИлїЪ.txt
%TEMP%\4C0A.tmp\Script\¶·КЮіЎ\¶·КЮіЎµНј¶.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\ИЛУгЦРјд .txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\ґФБЦµШґш5ЈЁ°Е±ИНЮНЮ¶ЬЈ©ХэКЅ.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\ЙПЙПКч.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\°В¶ыїЁєЈ±Я2ЈЁА¶у¦Р·№ЦЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\°В¶ыїЁєЈ±Я1ЈЁу¦Р·№ЦЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\М«їХЛюЧоПВГж.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\Е®ОЧ.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\°В¶ыїЁєЈ±Я4ЈЁєЈРЗРЗЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\°В¶ыїЁєЈ±Я3ЈЁу¦Р·№ЦЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\їЙЕВµЪ3ґъ.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\№ЕДѕБЦИлїЪЈЁаЫЯЭ).txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\№ЕДѕґФБЦНЁµАЈЁАЗЈ©.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\М«їХЛюµҐЛў.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\µШµЧ¶ґСЁЈЁтщтрРДЈ©ХэКЅ.txt
%TEMP%\4C0A.tmp\Script\ІвКФИєДЪІїЅЕ±ѕ\»ШТфС©µШЈЁЗтЗтЈ©.txt
%TEMP%\4C0A.tmp\Script\ЙЯБъё±±ѕ\ЙЯБъЦ®іІ 4.txt
%TEMP%\4C0A.tmp\Script\ЙЯБъё±±ѕ\ЙЯБъЦ®іІ 3.txt
%TEMP%\4C0A.tmp\Script\ЙЯБъё±±ѕ\ЙЯБъЦ®іІ 2.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъРµ№¤ЧчКТ 1.txt
%TEMP%\4C0A.tmp\Script\ЙЯБъё±±ѕ\ЙЯБъЦ®іІ Йоґ¦.txt
%TEMP%\4C0A.tmp\Script\ЙЯБъё±±ѕ\ЙЯБъЦ®іІ 5.txt
%TEMP%\4C0A.tmp\Script\ЧФ¶Ї±±4ИҐ±±3Ј¬ФЪ±±3№Т»ъЅЕ±ѕ\°¬¶ыЖЅФ±±Ії 3.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\БъГЁРЎµЬ.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\»ЖјЧ.txt
%TEMP%\4C0A.tmp\Script\ЙЯБъё±±ѕ\ЙЯБъЦ®іІ 1.txt
%TEMP%\4C0A.tmp\Script\ЙЯБъё±±ѕ\ЖХВі¶ЩЙсµо4Іг.txt
%TEMP%\4C0A.tmp\Script\ЧФ¶Ї±±4ИҐ±±3Ј¬ФЪ±±3№Т»ъЅЕ±ѕ\°¬¶ыЖЅФ±±Ії 4.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъјЧЙЅВц(іцїЪ) 4.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъјЧЙЅВц(іцїЪ) 3.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъјЧЙЅВц(іцїЪ) 2.txt
%APPDATA%\4f41222c438c431407ce877bd5ab9228\Release.dll
%APPDATA%\4f41222c438c431407ce877bd5ab9228\crossfire.exe
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъјЧЙЅВц(іцїЪ) 5.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъРµ№¤ЧчКТ 3.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъРµ№¤ЧчКТ 3(И«Нј).txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъРµ№¤ЧчКТ 2.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъјЧЙЅВц(іцїЪ) 1.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъјЧЙЅВц(ИлїЪ) 1.txt
%TEMP%\4C0A.tmp\Script\ёЦМъіЗКР\»ъРµ№¤ЧчКТ 4.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\УоЦжїХјдХѕ1.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\М«їХЕ©іЎ 3.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\М«їХЕ©іЎ 2.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\їХјдСРѕїЛщ 1.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\±ИёҐВЮЛ№МШ.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\УоЦжїХјдХѕ5.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(»ЖјЧ)-ЖХВі¶ЩЙсµо4Іг.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(»ЖјЧ)-ЖХВі¶ЩЙсµо2Іг.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(ЖпКї)-ґєЦІНЁµА5.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\М«їХЕ©іЎ 1.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\ѕЮґуКЦЗ№.txt
%TEMP%\4C0A.tmp\Script\ПЎУРЅЕ±ѕ\(БъГЁ)-°Ў¶ыїЁµЫСЗ2.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\°®№.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\ЙоФЁ8.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\ЙоФЁ7.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\С©Е®.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\»ўЅд&МТ¶Ь.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\АЗГ¬З№.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\їХјдСРѕїЛщ 4.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\їХјдСРѕїЛщ 3.txt
%TEMP%\4C0A.tmp\Script\їХјдХѕ\їХјдСРѕїЛщ 2.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\ЙоФЁ6.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\ЙоФЁ5.txt
%TEMP%\4C0A.tmp\Script\ЅЕ±ѕ by УщУГПРЦн\ґЭЙЅ.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\№ЦОпґуПГ 130F.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ё»ИДїуіЎНЪїу.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ё»ИДµДїуіЎ.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ЙоФЁµДТЕЦ· 7.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\»ъјЧЙЅВц(іцїЪ) 2.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\їШЦЖКТ 3.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\М«їХЛю ЙП.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\Е©іЎ1 ЙП.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ИЛУгИ«Нј.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ё»ИДµДїуіЎ(ѕІТф).txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\±¦їв¶ґСЁ2.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\УоЦжїХјдХѕ5.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ѕ№ЛЩ.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ѕєЛЩ-јУЛЩ.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\їХјдСРѕїЛщ 3.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ХВУгЙсµо.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ХВУгBOSS.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ХВУг8.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ГЁН·УҐЦ®іЗ 5.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\СжКТ.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ЙоФЁµДТЕЦ· 8.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ЙсНЇґуПГЦЖФм.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ГЁН·УҐЦ®іЗ 8.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ГЁН·УҐЦ®іЗ 6.txt
%TEMP%\4C0A.tmp\Server.ini
%TEMP%\4C0A.tmp\Run.exe.Log
%TEMP%\4C0A.tmp\Release.dll
%TEMP%\4C0A.tmp\Script\new М«їХЕ©іЎ1И«Нј»ШїШЦЖ1\їШЦЖКТ 1.txt
%TEMP%\4C0A.tmp\Script\new М«їХЕ©іЎ1И«Нј»ШїШЦЖ1\М«їХЕ©іЎ 1.txt
%TEMP%\4C0A.tmp\Script\°¬¶ыЖЅФ±±Ії 4.txt
%TEMP%\4C0A.tmp\ChdXC.txt
%TEMP%\4C0A.tmp\ChdXC.exe
%TEMP%\410.tmp
%TEMP%\4C0A.tmp\HookXC.dll
%TEMP%\4C0A.tmp\hei.exe
%TEMP%\4C0A.tmp\Cook.DAT
%TEMP%\4C0A.tmp\Script\new ёЯј¶¶·КЮіЎ»Ш±ґВЮЛ№\±ґВЮЛ№іЗКР.txt
%TEMP%\4C0A.tmp\Script\new ёЯј¶¶·КЮіЎ»Ш±ґВЮЛ№\¶·КЮіЎµДµШПВНЁµА.txt
%TEMP%\4C0A.tmp\Script\new ёЯј¶¶·КЮіЎ»Ш±ґВЮЛ№\¶·КЮіЎИлїЪ.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ИЛУгЦРјд .txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\110fuben .txt
%TEMP%\4C0A.tmp\Script\new ёЯј¶¶·КЮіЎ»Ш±ґВЮЛ№\ёЯј¶¶·КЮіЎІ»ДЬїЄЖфїмЛЩЕАМЭ
%TEMP%\4C0A.tmp\Script\new НґїаєЈ°¶2И«Нј»Ш·вУЎЛю\·вУЎЦ®ЛюИлїЪ.txt
%TEMP%\4C0A.tmp\Script\new УоЦжїХјдХѕ5ЦРПВНјС»·»ШїШЦЖ1\їШЦЖКТ 1.txt
%TEMP%\4C0A.tmp\Script\new УоЦжїХјдХѕ5ЦРПВНјС»·»ШїШЦЖ1\УоЦжїХјдХѕ5.txt
%TEMP%\4C0A.tmp\Script\new ёЯј¶¶·КЮіЎ»Ш±ґВЮЛ№\¶·КЮіЎ ёЯј¶ХЅіЎ.txt
%TEMP%\4C0A.tmp\Script\new НґїаєЈ°¶2И«Нј»Ш·вУЎЛю\НґїаєЈ°¶ 3.txt
%TEMP%\4C0A.tmp\Script\new НґїаєЈ°¶2И«Нј»Ш·вУЎЛю\НґїаєЈ°¶ 2.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\РЭПўМь.txt
%TEMP%\4C0A.tmp\Script\±±1234\°¬¶ыЖЅФ±±Ії 4.txt
%TEMP%\4C0A.tmp\Script\±±1234\°¬¶ыЖЅФ±±Ії 3.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 121F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\Ѕ±АшМь 1єЕ·ї.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\ґуПГ.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\22µЫ№ъѕ«Ис±ші¤.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\21µЫ№ъѕ«Ис±ш.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\20µЫ№ъІЁ±И.txt
%TEMP%\4C0A.tmp\Script\±±1234\°¬¶ыЖЅФ±±Ії 2.txt
%TEMP%\4C0A.tmp\Script\±±1234\°¬¶ы±±ІїЙПИ« 1.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\23¶йВдµДµЫ№ъУО»чЖпКї..txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 130F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 129F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 128F.txt
%TEMP%\4C0A.tmp\Script\¶·КЮіЎ\¶·КЮіЎЦРј¶ј¶ЎЈ.txt
%TEMP%\4C0A.tmp\Script\КХ·СµШНј\Ўп ±¦їв¶ґСЁ2.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ ґуМь.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 124F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 123F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 122F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 127F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 126F.txt
%TEMP%\4C0A.tmp\Script\ґуПГ\№ЦОпґуПГ 125F.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\04±©ВТµДїЛІ©МШ»рЗ№КЦ.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\03±©ВТµДїЛІ©МШјыП°З№КЦ.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\02±©ВТµДїЛІ©МШЅьОА¶У.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\07¶йВдµДµЫ№ъѕ«Ис±ші¤.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\06¶йВдµДµЫ№ъѕ«Ис±ш.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\05¶йВдµДµЫ№ъІЁ±И.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ГФЦ®УЈКчєю3.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ГФ3Чу.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\°¬¶ыЖЅФ±±Ії 4.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\01±©ВТµДїЛІ©МШјыП°ЖпКї.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ёЯј¶¶·КЮЅЕ±ѕ.txt
%TEMP%\4C0A.tmp\Script\ЖдЛыЅЕ±ѕ\ГФЦ®УЈКчєю4.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\16·Йµ°»рЗ№КЦ.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\15·Йµ°·ЁК¦.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\14·Йµ°ХЅКї.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\19їЛІ©МШ»рЗ№КЦ.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\18їЛІ©МШЅьОА¶У.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\17їЛІ©МШјыП°ЖпКї.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\10°В±Иѕ«Бй.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\09РЎєЪСт.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\08РЎГаСт.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\13¶№¶№№јэКЦ.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\12¶№¶№ЖпКї.txt
%TEMP%\4C0A.tmp\Script\ё±Ц°ИООсґуИ«јЇ\11¶№¶№±шКї.txt

Sets the 'hidden' attribute to the following files:

%APPDATA%\4f41222c438c431407ce877bd5ab9228\Release.dll

Network activity:

Connects to:

'zg####789.gnway.org':3333
'tx#.#hdxc.com':80

TCP:

HTTP GET requests:

http://tx#.#hdxc.com/up1509241.txt

UDP:

DNS ASK zg####789.gnway.org
DNS ASK tx#.#hdxc.com

Miscellaneous:

Searches for the following windows:

ClassName: 'SHELLDLL_DefView' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Progman' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial