Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'ImagePath' = '%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'
- C:\Far2\Far.exe
- hidden files
- file extensions
- User Account Control (UAC)
- '<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\lmgMQgsM.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\McwEMogA.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CuMsQYUI.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZskUsUIA.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tuMcAQUU.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\uIwoUAko.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RoEQIQIk.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RmQIUYMc.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\bwYoYEcg.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\wMEIMEoc.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\hIIsoQwk.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\GygMwQMo.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AgEYUsUs.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\USEYowQk.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\vmkMYgcQ.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WCcIYcoQ.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\VmAwooAo.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\NGIkYEkY.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\IkcEocwI.bat" "<Full path to file>""
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WSIQAIwM.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\wmcYkEok.bat" "<Full path to file>""
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
- '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
- '%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\vOcEgQcU.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\SAoMQocs.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\JwEgYUIQ.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MYYksYoU.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\wwAMEEUg.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\HukQkowk.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\fWoAMcIg.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\DisYcQcY.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\wmMIAkEo.bat" "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\bmcUkQwE.bat" "<Full path to file>""
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- C:\RCX1C.tmp
- <Current directory>\EssA.exe
- <Current directory>\CgsA.ico
- %TEMP%\IkcEocwI.bat
- C:\RCX1D.tmp
- <Current directory>\PsAy.exe
- <Current directory>\zQwM.ico
- <Current directory>\MoQE.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %TEMP%\WCcIYcoQ.bat
- <Current directory>\JwIe.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %TEMP%\AKQMYAcU.bat
- C:\RCX1B.tmp
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- <Current directory>\ycAU.exe
- <Current directory>\uwkI.ico
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- C:\RCX20.tmp
- %TEMP%\ZSMYooAM.bat
- %TEMP%\NGIkYEkY.bat
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %TEMP%\QCIoIQAM.bat
- C:\RCX1E.tmp
- <Current directory>\FQwc.exe
- <Current directory>\eqgQ.ico
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- C:\RCX1F.tmp
- <Current directory>\CsUG.exe
- <Current directory>\sGkU.ico
- C:\RCX1A.tmp
- C:\RCX15.tmp
- <Current directory>\uAEy.exe
- <Current directory>\LAAY.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- <Current directory>\QMAi.exe
- %TEMP%\BQkQwEIo.bat
- <Current directory>\Eugs.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- C:\RCX13.tmp
- %TEMP%\VmAwooAo.bat
- <Current directory>\JAUm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- C:\RCX14.tmp
- <Current directory>\uIAk.exe
- <Current directory>\VIMs.ico
- C:\RCX16.tmp
- <Current directory>\IUYk.exe
- <Current directory>\KKco.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- C:\RCX19.tmp
- <Current directory>\jcsm.exe
- <Current directory>\FWMo.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- C:\RCX18.tmp
- <Current directory>\ocMC.exe
- <Current directory>\NuQU.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- C:\RCX17.tmp
- <Current directory>\EEgk.exe
- <Current directory>\vmQE.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %TEMP%\vmkMYgcQ.bat
- <Current directory>\FOEE.ico
- <STUBS_DIR>\AVP\AVP.EXE.exe
- C:\RCX2B.tmp
- <Current directory>\xgYY.exe
- <Current directory>\ziMg.ico
- <STUBS_DIR>\AVP32\AVP32.EXE.exe
- C:\RCX2C.tmp
- <Current directory>\Ycwc.exe
- <Current directory>\KkYe.exe
- <Current directory>\aIII.ico
- <STUBS_DIR>\AVGCC32\AVGCC32.EXE.exe
- C:\RCX2A.tmp
- %TEMP%\VOEYkQQU.bat
- <Current directory>\KusA.ico
- <STUBS_DIR>\AVGCTRL\AVGCTRL.EXE.exe
- <Current directory>\uoMo.exe
- <STUBS_DIR>\AVSYNMGR\AVSYNMGR.EXE.exe
- C:\RCX2F.tmp
- <Current directory>\Sowe.exe
- <Current directory>\QCoQ.ico
- C:\RCX30.tmp
- %TEMP%\WwIwsEwM.bat
- <Current directory>\tIgO.exe
- <Current directory>\bwsQ.ico
- %TEMP%\AgEYUsUs.bat
- <STUBS_DIR>\AVPCC\AVPCC.EXE.exe
- C:\RCX2D.tmp
- <Current directory>\uysI.ico
- <STUBS_DIR>\AVPM\AVPM.EXE.exe
- C:\RCX2E.tmp
- <Current directory>\DAQK.exe
- C:\RCX29.tmp
- C:\RCX23.tmp
- <Current directory>\LkwG.exe
- <Current directory>\Eqcg.ico
- <Current directory>\sMYU.ico
- %TEMP%\hIIsoQwk.bat
- C:\RCX24.tmp
- <Current directory>\mkgU.exe
- C:\RCX22.tmp
- %TEMP%\GygMwQMo.bat
- <Current directory>\zMks.exe
- <Current directory>\teMk.ico
- C:\RCX21.tmp
- <Current directory>\UgoU.exe
- <Current directory>\hgEI.ico
- %TEMP%\dwIcAwwg.bat
- <Current directory>\Mago.ico
- <Current directory>\QAEM.exe
- <Current directory>\MIsY.ico
- C:\RCX27.tmp
- C:\RCX28.tmp
- <Current directory>\IEAq.exe
- <Current directory>\iqoE.ico
- %TEMP%\USEYowQk.bat
- <Current directory>\QogU.exe
- <Current directory>\IYEk.ico
- C:\RCX25.tmp
- <Current directory>\NYEi.exe
- %TEMP%\LmIcAEYk.bat
- <Current directory>\mCok.ico
- C:\RCX26.tmp
- <Current directory>\YQce.exe
- C:\RCX5.tmp
- <Current directory>\rIse.exe
- <Current directory>\boQo.ico
- %TEMP%\HukQkowk.bat
- <Current directory>\dsIg.exe
- <Current directory>\JSgc.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- C:\RCX3.tmp
- <Current directory>\NoAM.exe
- <Current directory>\tQsg.ico
- %TEMP%\RwoggwgU.bat
- C:\RCX4.tmp
- <Current directory>\HcQK.exe
- C:\RCX6.tmp
- C:\RCX8.tmp
- <Current directory>\KAYK.exe
- %TEMP%\rgQgscwM.bat
- %TEMP%\SAoMQocs.bat
- %TEMP%\aakIIgoA.bat
- <Current directory>\wawU.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- <Current directory>\xKks.ico
- %TEMP%\JwEgYUIQ.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %TEMP%\eIwksEkY.bat
- <Current directory>\JKsA.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- C:\RCX7.tmp
- <Current directory>\xAEo.exe
- <Current directory>\uGcw.ico
- %ALLUSERSPROFILE%\casg.txt
- %TEMP%\wmcYkEok.bat
- %TEMP%\LKQkggIY.bat
- %TEMP%\fMogUgwk.bat
- %TEMP%\WSIQAIwM.bat
- <Current directory>\EqUk.ico
- %TEMP%\file.vbs
- <Current directory>\<File name>
- %HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe
- %ALLUSERSPROFILE%\vesswIQA\AcIcUcAM
- %HOMEPATH%\NIMMEwsg\jaQEcQMQ
- %ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe
- %TEMP%\zMMQQgoc.bat
- C:\Documents and Settings\LocalService\NIMMEwsg\jaQEcQMQ
- %ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
- <Current directory>\JsUy.exe
- %TEMP%\bmcUkQwE.bat
- <Current directory>\RUUi.exe
- %TEMP%\aSMEcIow.bat
- C:\RCX2.tmp
- %TEMP%\wmMIAkEo.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %TEMP%\oUoIAckg.bat
- %TEMP%\fWoAMcIg.bat
- %TEMP%\vOcEgQcU.bat
- C:\RCX1.tmp
- %TEMP%\rwEIoogM.bat
- %TEMP%\nOcEEQcE.bat
- <Current directory>\UOsk.ico
- %TEMP%\IuAgcoYU.bat
- %TEMP%\DisYcQcY.bat
- <Current directory>\FEMs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %TEMP%\lmgMQgsM.bat
- C:\RCXF.tmp
- <Current directory>\qQwo.ico
- C:\RCX10.tmp
- <Current directory>\dgQm.exe
- %TEMP%\JewwgUoY.bat
- <Current directory>\pgAe.exe
- <Current directory>\OkEM.exe
- %TEMP%\McwEMogA.bat
- <Current directory>\akgg.ico
- C:\RCXE.tmp
- <Current directory>\taEQ.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %TEMP%\PccoEoUQ.bat
- %TEMP%\ZskUsUIA.bat
- C:\RCX12.tmp
- <Current directory>\SEcC.exe
- <Current directory>\VoQI.ico
- %TEMP%\wMEIMEoc.bat
- <Current directory>\AwQw.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %TEMP%\JWYIUUkw.bat
- %TEMP%\CgkQIMow.bat
- <Current directory>\doYg.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %TEMP%\AIEUUMQs.bat
- <Current directory>\VEQe.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- C:\RCX11.tmp
- %TEMP%\CuMsQYUI.bat
- %TEMP%\tuMcAQUU.bat
- <Current directory>\LOcA.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %TEMP%\dcEQQkks.bat
- %TEMP%\RoEQIQIk.bat
- C:\RCXB.tmp
- %TEMP%\YAoIQgQg.bat
- <Current directory>\SMse.exe
- %TEMP%\MYYksYoU.bat
- %TEMP%\ymgkMYUE.bat
- %TEMP%\wwAMEEUg.bat
- C:\RCX9.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- C:\RCXA.tmp
- <Current directory>\HQcA.exe
- <Current directory>\ykcM.ico
- %TEMP%\uIwoUAko.bat
- %TEMP%\acsMIgAA.bat
- <Current directory>\hYYS.exe
- <Current directory>\gUgA.ico
- %TEMP%\RmQIUYMc.bat
- %TEMP%\mwcUAwYE.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- C:\RCXD.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %TEMP%\bwYoYEcg.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %TEMP%\ByQkIcoo.bat
- <Current directory>\IAQs.ico
- C:\RCXC.tmp
- %TEMP%\IKoQgYsI.bat
- <Current directory>\pIIU.exe
- <Current directory>\CgsA.ico
- <Current directory>\FQwc.exe
- <Current directory>\eqgQ.ico
- <Current directory>\PsAy.exe
- %TEMP%\AKQMYAcU.bat
- <Current directory>\EssA.exe
- <Current directory>\zQwM.ico
- <Current directory>\CsUG.exe
- %TEMP%\ZSMYooAM.bat
- <Current directory>\zMks.exe
- <Current directory>\teMk.ico
- %TEMP%\QCIoIQAM.bat
- <Current directory>\sGkU.ico
- <Current directory>\ycAU.exe
- <Current directory>\uwkI.ico
- <Current directory>\MoQE.ico
- <Current directory>\Eugs.ico
- <Current directory>\ocMC.exe
- %TEMP%\BQkQwEIo.bat
- <Current directory>\QMAi.exe
- <Current directory>\VIMs.ico
- <Current directory>\uAEy.exe
- <Current directory>\LAAY.ico
- <Current directory>\NuQU.ico
- <Current directory>\jcsm.exe
- <Current directory>\FWMo.ico
- <Current directory>\JwIe.exe
- <Current directory>\KKco.ico
- <Current directory>\EEgk.exe
- <Current directory>\vmQE.ico
- <Current directory>\IUYk.exe
- %TEMP%\VOEYkQQU.bat
- <Current directory>\Ycwc.exe
- <Current directory>\KusA.ico
- <Current directory>\aIII.ico
- <Current directory>\IEAq.exe
- <Current directory>\iqoE.ico
- <Current directory>\KkYe.exe
- <Current directory>\xgYY.exe
- <Current directory>\uysI.ico
- <Current directory>\Sowe.exe
- <Current directory>\bwsQ.ico
- <Current directory>\DAQK.exe
- <Current directory>\FOEE.ico
- <Current directory>\uoMo.exe
- <Current directory>\ziMg.ico
- <Current directory>\MIsY.ico
- <Current directory>\Eqcg.ico
- <Current directory>\mkgU.exe
- <Current directory>\sMYU.ico
- <Current directory>\LkwG.exe
- %TEMP%\dwIcAwwg.bat
- <Current directory>\UgoU.exe
- <Current directory>\hgEI.ico
- <Current directory>\NYEi.exe
- <Current directory>\QogU.exe
- <Current directory>\mCok.ico
- <Current directory>\QAEM.exe
- <Current directory>\IYEk.ico
- <Current directory>\Mago.ico
- <Current directory>\YQce.exe
- %TEMP%\LmIcAEYk.bat
- <Current directory>\uIAk.exe
- <Current directory>\dsIg.exe
- <Current directory>\JSgc.ico
- <Current directory>\xAEo.exe
- %TEMP%\eIwksEkY.bat
- <Current directory>\tQsg.ico
- <Current directory>\rIse.exe
- <Current directory>\boQo.ico
- <Current directory>\JKsA.ico
- <Current directory>\FEMs.exe
- %TEMP%\ymgkMYUE.bat
- <Current directory>\wawU.ico
- %TEMP%\aakIIgoA.bat
- %TEMP%\rgQgscwM.bat
- <Current directory>\KAYK.exe
- <Current directory>\xKks.ico
- <Current directory>\HcQK.exe
- <Current directory>\JsUy.exe
- <Current directory>\EqUk.ico
- %TEMP%\nOcEEQcE.bat
- %TEMP%\rwEIoogM.bat
- %TEMP%\zMMQQgoc.bat
- %TEMP%\LKQkggIY.bat
- %TEMP%\fMogUgwk.bat
- %TEMP%\IuAgcoYU.bat
- <Current directory>\NoAM.exe
- <Current directory>\uGcw.ico
- %TEMP%\RwoggwgU.bat
- <Current directory>\UOsk.ico
- %TEMP%\aSMEcIow.bat
- %TEMP%\oUoIAckg.bat
- <Current directory>\RUUi.exe
- <Current directory>\dgQm.exe
- %TEMP%\AIEUUMQs.bat
- <Current directory>\qQwo.ico
- %TEMP%\JewwgUoY.bat
- <Current directory>\akgg.ico
- <Current directory>\pgAe.exe
- <Current directory>\taEQ.ico
- <Current directory>\VEQe.exe
- <Current directory>\VoQI.ico
- <Current directory>\JAUm.exe
- <Current directory>\AwQw.ico
- %TEMP%\JWYIUUkw.bat
- <Current directory>\doYg.ico
- %TEMP%\CgkQIMow.bat
- <Current directory>\SEcC.exe
- %TEMP%\PccoEoUQ.bat
- %TEMP%\ByQkIcoo.bat
- <Current directory>\SMse.exe
- <Current directory>\LOcA.ico
- %TEMP%\YAoIQgQg.bat
- <Current directory>\HQcA.exe
- %TEMP%\dcEQQkks.bat
- <Current directory>\ykcM.ico
- %TEMP%\IKoQgYsI.bat
- <Current directory>\gUgA.ico
- %TEMP%\mwcUAwYE.bat
- <Current directory>\OkEM.exe
- <Current directory>\hYYS.exe
- <Current directory>\pIIU.exe
- <Current directory>\IAQs.ico
- %TEMP%\acsMIgAA.bat
- <Current directory>\ycAU.exe
- <Current directory>\CsUG.exe
- <Current directory>\zMks.exe
- <Current directory>\LkwG.exe
- <Current directory>\UgoU.exe
- <Current directory>\FQwc.exe
- <Current directory>\jcsm.exe
- <Current directory>\IUYk.exe
- <Current directory>\JwIe.exe
- <Current directory>\PsAy.exe
- <Current directory>\EssA.exe
- <Current directory>\mkgU.exe
- <Current directory>\xgYY.exe
- <Current directory>\Ycwc.exe
- <Current directory>\uoMo.exe
- <Current directory>\Sowe.exe
- <Current directory>\DAQK.exe
- <Current directory>\KkYe.exe
- <Current directory>\YQce.exe
- <Current directory>\NYEi.exe
- <Current directory>\QogU.exe
- <Current directory>\IEAq.exe
- <Current directory>\QAEM.exe
- <Current directory>\EEgk.exe
- <Current directory>\KAYK.exe
- <Current directory>\xAEo.exe
- <Current directory>\FEMs.exe
- <Current directory>\SMse.exe
- <Current directory>\HQcA.exe
- <Current directory>\dsIg.exe
- <Current directory>\RUUi.exe
- <Current directory>\JsUy.exe
- <Current directory>\NoAM.exe
- <Current directory>\rIse.exe
- <Current directory>\HcQK.exe
- <Current directory>\pIIU.exe
- <Current directory>\uIAk.exe
- <Current directory>\JAUm.exe
- <Current directory>\uAEy.exe
- <Current directory>\ocMC.exe
- <Current directory>\QMAi.exe
- <Current directory>\SEcC.exe
- <Current directory>\OkEM.exe
- <Current directory>\hYYS.exe
- <Current directory>\pgAe.exe
- <Current directory>\VEQe.exe
- <Current directory>\dgQm.exe
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- DNS ASK google.com
- ClassName: '' WindowName: 'jaQEcQMQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'AcIcUcAM.exe'