La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Trojan.MulDrop11.52510

Aggiunto al database dei virus Dr.Web: 2020-03-29

La descrizione è stata aggiunta:

Technical Information

Malicious functions
Executes the following
  • '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program="<Full path to file>"
Modifies file system
Creates the following files
  • %WINDIR%\scripttemp.ini
  • %WINDIR%\_temp03292026504799\oem\cert\philco.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\positi.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\prdgt.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\qbexco.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\quanmx.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\rm.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\seccsd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\sony.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\stinfo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\synnex.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\sysmax.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tarox1.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\thoa21.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\thtfpc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosasu.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\onkyo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\itinfo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\olislp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\oegrou.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\jooyon.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\k.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\krftwy.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lanix1.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lenovo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lge.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\login2.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\matbio.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\matech.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\medion.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\mitac.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\msi_nb.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\navihb.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\nec.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\nokia.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\olipro.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\jetway.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosbyd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosqci.xrm-ms
  • %WINDIR%\_temp03292026504799\x64\fakeclient.exe
  • %WINDIR%\_temp03292026504799\x64\msvcr100.dll
  • %WINDIR%\_temp03292026504799\x64\secopatcher.dll
  • %WINDIR%\_temp03292026504799\x64\setacl.exe
  • %WINDIR%\_temp03292026504799\x64\sppextcomobjhook.dll
  • %WINDIR%\_temp03292026504799\x64\windivert.dll
  • %WINDIR%\_temp03292026504799\oem\cert\benq.xrm-ms
  • %WINDIR%\_temp03292026504799\x64\windivert64.sys
  • %WINDIR%\_temp03292026504799\x86\fakeclient.exe
  • %WINDIR%\_temp03292026504799\x86\msvcr100.dll
  • %WINDIR%\_temp03292026504799\x86\secopatcher.dll
  • %WINDIR%\_temp03292026504799\x86\setacl.exe
  • %WINDIR%\_temp03292026504799\x86\sppextcomobjhook.dll
  • %WINDIR%\_temp03292026504799\x86\windivert.dll
  • %WINDIR%\_temp03292026504799\kms_x64.exe
  • %WINDIR%\_temp03292026504799\x64\cleanospp.exe
  • %WINDIR%\_temp03292026504799\oem\cert\toshib.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\toscpl.xrm-ms
  • %WINDIR%\_temp03292026504799\kms-server.exe
  • %WINDIR%\_temp03292026504799\oem\cert\trigem.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\vestel.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\vscaio.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\wortma.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\xplore.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\yutc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\_asus_.xrm-ms
  • %WINDIR%\_temp03292026504799\heu_kms_renewal.xml
  • %WINDIR%\_temp03292026504799\oem\bootrest.exe
  • %WINDIR%\_temp03292026504799\oem\efi.exe
  • %WINDIR%\_temp03292026504799\oem\oemboot.exe
  • %WINDIR%\_temp03292026504799\oem\oemdumpnet35.exe
  • %WINDIR%\_temp03292026504799\oem\oemdumpnet40.exe
  • %WINDIR%\_temp03292026504799\kms-client.exe
  • %WINDIR%\_temp03292026504799\oem\cert\tosinv.xrm-ms
  • %WINDIR%\_temp03292026504799\kms.exe
  • %WINDIR%\_temp03292026504799\oem\cert\ibm.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hyrslp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hspw07.xrm-ms
  • %WINDIR%\_temp03292026504799\pic\ewm_zfb.jpg
  • %WINDIR%\_temp03292026504799\pic\head.jpg
  • %WINDIR%\_temp03292026504799\pic\left.jpg
  • %WINDIR%\_temp03292026504799\pic\office.jpg
  • %WINDIR%\_temp03292026504799\pic\shuoming.jpg
  • %WINDIR%\_temp03292026504799\pic\windows.jpg
  • %WINDIR%\_temp03292026504799\pic\backup.bmp
  • %WINDIR%\_temp03292026504799\pic\restore.bmp
  • %WINDIR%\_temp03292026504799\pic\uninst.bmp
  • %WINDIR%\_temp03292026504799\pic\amt.ico
  • %WINDIR%\_temp03292026504799\pic\ver.ico
  • %WINDIR%\_temp03292026504799\pic\zanzhu.ico
  • %WINDIR%\_temp03292026504799\office2010ospp\slerror.xml
  • %WINDIR%\_temp03292026504799\otherofficeospp\slerror.xml
  • %WINDIR%\_temp03292026504799\oem\gr1dr7
  • %WINDIR%\_temp03292026504799\svctrigger.xml
  • %WINDIR%\_temp03292026504799\oem\gr1dr6
  • %WINDIR%\_temp03292026504799\oem\gr1dr34
  • %TEMP%\aut9e9e.tmp
  • %WINDIR%\splashlogo.gif
  • %TEMP%\autb8ce.tmp
  • %WINDIR%\_temp03292026504799\kmsmini.7z
  • %TEMP%\autbaf2.tmp
  • %WINDIR%\_temp03292026504799\digital.7z
  • %TEMP%\autbbaf.tmp
  • %WINDIR%\_temp03292026504799\cert.7z
  • %TEMP%\autbc6b.tmp
  • %WINDIR%\_temp03292026504799\digitallicence.7z
  • %TEMP%\autbcf9.tmp
  • %WINDIR%\_temp03292026504799\7z.exe
  • %WINDIR%\heukmsrenewal\heu_kms_activator.exe
  • %WINDIR%\_temp03292026504799\oem\gr1dr1
  • %WINDIR%\_temp03292026504799\oem\gr1dr2
  • %WINDIR%\_temp03292026504799\oem\gr1dr5
  • %WINDIR%\_temp03292026504799\office2010ospp\ospp.vbs
  • %WINDIR%\_temp03292026504799\pic\ewm_wx.jpg
  • %WINDIR%\_temp03292026504799\otherofficeospp\ospp.vbs
  • %WINDIR%\_temp03292026504799\oem\cert\equus.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\exo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\foundr.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\fsc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\fuj.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\gbt.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\gensys.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\haier.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hasee.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hclinf.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hedy06.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\higrad.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hpqoem.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\dsgltd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\dealin.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\exc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\dell.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\datate.xrm-ms
  • %WINDIR%\_temp03292026504799\heu_configuration.ini
  • %WINDIR%\_temp03292026504799\getproductkey.data
  • %WINDIR%\_temp03292026504799\setupcomplete.data
  • %WINDIR%\_temp03292026504799\oem\cert\acrsys.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\alware.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\aquari.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\atcomp.xrm-ms
  • %WINDIR%\_temp03292026504799\x86\windivert32.sys
  • %WINDIR%\_temp03292026504799\x86\cleanospp.exe
  • %WINDIR%\_temp03292026504799\oem\cert\bekopc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\casper.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\ccelnf.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\cgwall.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\cmscom.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\creaas.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\czc011.xrm-ms
  • %WINDIR%\_temp03292026504799\heu_set.ini
  • %WINDIR%\_temp03292026504799\oem\cert\bgh.xrm-ms
  • %WINDIR%\_temp03292026504799\scriptdir.ini
Sets the 'hidden' attribute to the following files
  • %WINDIR%\_temp03292026504799\oem\gr1dr1
  • %WINDIR%\_temp03292026504799\oem\cert\toshib.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\toscpl.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosbyd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosasu.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\thtfpc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\thoa21.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tarox1.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\sysmax.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\synnex.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\stinfo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\sony.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\seccsd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\rm.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\quanmx.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lge.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\qbexco.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\positi.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\philco.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\onkyo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\olislp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\olipro.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\oegrou.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\nokia.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\nec.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\navihb.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\msi_nb.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\mitac.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\medion.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\matech.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\matbio.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\prdgt.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\login2.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosinv.xrm-ms
  • %WINDIR%\_temp03292026504799\kms.exe
  • %WINDIR%\_temp03292026504799\x64\cleanospp.exe
  • %WINDIR%\_temp03292026504799\x64\fakeclient.exe
  • %WINDIR%\_temp03292026504799\x64\msvcr100.dll
  • %WINDIR%\_temp03292026504799\x64\secopatcher.dll
  • %WINDIR%\_temp03292026504799\x64\setacl.exe
  • %WINDIR%\_temp03292026504799\x64\sppextcomobjhook.dll
  • %WINDIR%\_temp03292026504799\x64\windivert64.sys
  • %WINDIR%\_temp03292026504799\oem\cert\dell.xrm-ms
  • %WINDIR%\_temp03292026504799\x86\cleanospp.exe
  • %WINDIR%\_temp03292026504799\x86\fakeclient.exe
  • %WINDIR%\_temp03292026504799\x86\msvcr100.dll
  • %WINDIR%\_temp03292026504799\x86\secopatcher.dll
  • %WINDIR%\_temp03292026504799\x86\setacl.exe
  • %WINDIR%\_temp03292026504799\x86\sppextcomobjhook.dll
  • %WINDIR%\_temp03292026504799\oem\cert\trigem.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosqci.xrm-ms
  • %WINDIR%\_temp03292026504799\kms-client.exe
  • %WINDIR%\_temp03292026504799\kms-server.exe
  • %WINDIR%\_temp03292026504799\oem\oemdumpnet40.exe
  • %WINDIR%\_temp03292026504799\oem\oemdumpnet35.exe
  • %WINDIR%\_temp03292026504799\oem\oemboot.exe
  • %WINDIR%\_temp03292026504799\oem\efi.exe
  • %WINDIR%\_temp03292026504799\oem\bootrest.exe
  • %WINDIR%\_temp03292026504799\heu_kms_renewal.xml
  • %WINDIR%\_temp03292026504799\oem\cert\_asus_.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\yutc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\xplore.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\wortma.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\vscaio.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\vestel.xrm-ms
  • %WINDIR%\_temp03292026504799\kms_x64.exe
  • %WINDIR%\_temp03292026504799\oem\cert\lenovo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lanix1.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\krftwy.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\aquari.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\alware.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\acrsys.xrm-ms
  • %WINDIR%\_temp03292026504799\setupcomplete.data
  • %WINDIR%\_temp03292026504799\getproductkey.data
  • %WINDIR%\_temp03292026504799\heu_set.ini
  • %WINDIR%\_temp03292026504799\otherofficeospp\ospp.vbs
  • %WINDIR%\_temp03292026504799\office2010ospp\ospp.vbs
  • %WINDIR%\_temp03292026504799\svctrigger.xml
  • %WINDIR%\_temp03292026504799\otherofficeospp\slerror.xml
  • %WINDIR%\_temp03292026504799\office2010ospp\slerror.xml
  • %WINDIR%\_temp03292026504799\pic\zanzhu.ico
  • %WINDIR%\_temp03292026504799\pic\ver.ico
  • %WINDIR%\_temp03292026504799\oem\cert\bekopc.xrm-ms
  • %WINDIR%\_temp03292026504799\pic\amt.ico
  • %WINDIR%\_temp03292026504799\pic\restore.bmp
  • %WINDIR%\_temp03292026504799\pic\backup.bmp
  • %WINDIR%\_temp03292026504799\pic\windows.jpg
  • %WINDIR%\_temp03292026504799\pic\shuoming.jpg
  • %WINDIR%\_temp03292026504799\pic\office.jpg
  • %WINDIR%\_temp03292026504799\pic\left.jpg
  • %WINDIR%\_temp03292026504799\pic\head.jpg
  • %WINDIR%\_temp03292026504799\pic\ewm_zfb.jpg
  • %WINDIR%\_temp03292026504799\pic\ewm_wx.jpg
  • %WINDIR%\_temp03292026504799\oem\gr1dr7
  • %WINDIR%\_temp03292026504799\oem\gr1dr6
  • %WINDIR%\_temp03292026504799\oem\gr1dr5
  • %WINDIR%\_temp03292026504799\oem\gr1dr34
  • %WINDIR%\_temp03292026504799\oem\gr1dr2
  • %WINDIR%\_temp03292026504799\pic\uninst.bmp
  • %WINDIR%\_temp03292026504799\oem\cert\benq.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\atcomp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\bgh.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\k.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\gbt.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\jooyon.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\jetway.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\itinfo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\ibm.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hyrslp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hspw07.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hpqoem.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\higrad.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hedy06.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hclinf.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hasee.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\haier.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\gensys.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\fuj.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\casper.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\fsc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\foundr.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\exo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\exc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\equus.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\dsgltd.xrm-ms
  • %WINDIR%\_temp03292026504799\x64\windivert.dll
  • %WINDIR%\_temp03292026504799\oem\cert\dealin.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\datate.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\czc011.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\creaas.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\cmscom.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\cgwall.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\ccelnf.xrm-ms
  • %WINDIR%\_temp03292026504799\x86\windivert.dll
  • %WINDIR%\_temp03292026504799\x86\windivert32.sys
Deletes the following files
  • %TEMP%\aut9e9e.tmp
  • %WINDIR%\_temp03292026504799\oem\cert\synnex.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\sysmax.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tarox1.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\thoa21.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\thtfpc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosasu.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosbyd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\toscpl.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\toshib.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosinv.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\tosqci.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\trigem.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\vestel.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\vscaio.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\wortma.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\stinfo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\matbio.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\sony.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\rm.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\medion.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\mitac.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\msi_nb.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\navihb.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\nec.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\nokia.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\oegrou.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\olipro.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\olislp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\onkyo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\philco.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\positi.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\prdgt.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\qbexco.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\quanmx.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\seccsd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\matech.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\xplore.xrm-ms
  • %WINDIR%\_temp03292026504799\office2010ospp\slerror.xml
  • %WINDIR%\_temp03292026504799\x64\secopatcher.dll
  • %WINDIR%\_temp03292026504799\x64\setacl.exe
  • %WINDIR%\_temp03292026504799\x64\sppextcomobjhook.dll
  • %WINDIR%\_temp03292026504799\x64\windivert.dll
  • %WINDIR%\_temp03292026504799\x64\windivert64.sys
  • %WINDIR%\_temp03292026504799\x86\cleanospp.exe
  • %WINDIR%\_temp03292026504799\oem\cert\dealin.xrm-ms
  • %WINDIR%\_temp03292026504799\x86\fakeclient.exe
  • %WINDIR%\_temp03292026504799\x86\secopatcher.dll
  • %WINDIR%\_temp03292026504799\x86\setacl.exe
  • %WINDIR%\_temp03292026504799\x86\sppextcomobjhook.dll
  • %WINDIR%\_temp03292026504799\x86\windivert.dll
  • %WINDIR%\_temp03292026504799\x86\windivert32.sys
  • %WINDIR%\heukmsrenewal\heu_kms_activator.exe
  • %WINDIR%\_temp03292026504799\x64\fakeclient.exe
  • %WINDIR%\_temp03292026504799\x64\msvcr100.dll
  • %WINDIR%\_temp03292026504799\oem\cert\_asus_.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\yutc.xrm-ms
  • %WINDIR%\_temp03292026504799\pic\windows.jpg
  • %WINDIR%\_temp03292026504799\otherofficeospp\ospp.vbs
  • %WINDIR%\_temp03292026504799\otherofficeospp\slerror.xml
  • %WINDIR%\_temp03292026504799\pic\amt.ico
  • %WINDIR%\_temp03292026504799\pic\backup.bmp
  • %WINDIR%\_temp03292026504799\pic\ewm_wx.jpg
  • %WINDIR%\_temp03292026504799\pic\ewm_zfb.jpg
  • %WINDIR%\_temp03292026504799\pic\head.jpg
  • %WINDIR%\_temp03292026504799\pic\left.jpg
  • %WINDIR%\_temp03292026504799\pic\office.jpg
  • %WINDIR%\_temp03292026504799\pic\restore.bmp
  • %WINDIR%\_temp03292026504799\pic\shuoming.jpg
  • %WINDIR%\_temp03292026504799\pic\uninst.bmp
  • %WINDIR%\_temp03292026504799\pic\ver.ico
  • %WINDIR%\_temp03292026504799\pic\zanzhu.ico
  • %WINDIR%\_temp03292026504799\office2010ospp\ospp.vbs
  • %WINDIR%\_temp03292026504799\x64\cleanospp.exe
  • %WINDIR%\_temp03292026504799\oem\cert\login2.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lge.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lenovo.xrm-ms
  • %WINDIR%\_temp03292026504799\svctrigger.xml
  • %WINDIR%\_temp03292026504799\oem\bootrest.exe
  • %WINDIR%\_temp03292026504799\oem\efi.exe
  • %WINDIR%\_temp03292026504799\oem\gr1dr1
  • %WINDIR%\_temp03292026504799\oem\gr1dr2
  • %WINDIR%\_temp03292026504799\oem\gr1dr34
  • %WINDIR%\_temp03292026504799\oem\gr1dr5
  • %WINDIR%\_temp03292026504799\oem\gr1dr6
  • %WINDIR%\_temp03292026504799\oem\gr1dr7
  • %WINDIR%\_temp03292026504799\oem\oemboot.exe
  • %WINDIR%\_temp03292026504799\oem\oemdumpnet35.exe
  • %WINDIR%\_temp03292026504799\oem\oemdumpnet40.exe
  • %WINDIR%\_temp03292026504799\oem\cert\acrsys.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\alware.xrm-ms
  • %WINDIR%\_temp03292026504799\scriptdir.ini
  • %WINDIR%\_temp03292026504799\oem\cert\aquari.xrm-ms
  • %WINDIR%\_temp03292026504799\kms_x64.exe
  • %WINDIR%\_temp03292026504799\kms.exe
  • %TEMP%\autb8ce.tmp
  • %TEMP%\autbaf2.tmp
  • %TEMP%\autbbaf.tmp
  • %TEMP%\autbc6b.tmp
  • %TEMP%\autbcf9.tmp
  • %WINDIR%\_temp03292026504799\7z.exe
  • %WINDIR%\_temp03292026504799\cert.7z
  • %WINDIR%\_temp03292026504799\digital.7z
  • %WINDIR%\_temp03292026504799\digitallicence.7z
  • %WINDIR%\_temp03292026504799\getproductkey.data
  • %WINDIR%\_temp03292026504799\heu_configuration.ini
  • %WINDIR%\_temp03292026504799\heu_kms_renewal.xml
  • %WINDIR%\_temp03292026504799\heu_set.ini
  • %WINDIR%\_temp03292026504799\kms-client.exe
  • %WINDIR%\_temp03292026504799\kms-server.exe
  • %WINDIR%\_temp03292026504799\kmsmini.7z
  • %WINDIR%\_temp03292026504799\oem\cert\atcomp.xrm-ms
  • %WINDIR%\_temp03292026504799\setupcomplete.data
  • %WINDIR%\_temp03292026504799\oem\cert\bekopc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hasee.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hedy06.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\higrad.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hpqoem.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hspw07.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hyrslp.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\ibm.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\itinfo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\jetway.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\jooyon.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\k.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\krftwy.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\lanix1.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\haier.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\gbt.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\hclinf.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\gensys.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\fuj.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\benq.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\casper.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\ccelnf.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\cgwall.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\cmscom.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\creaas.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\czc011.xrm-ms
  • %WINDIR%\splashlogo.gif
  • %WINDIR%\_temp03292026504799\x86\msvcr100.dll
  • %WINDIR%\_temp03292026504799\oem\cert\datate.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\dsgltd.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\equus.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\exc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\exo.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\foundr.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\fsc.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\bgh.xrm-ms
  • %WINDIR%\_temp03292026504799\oem\cert\dell.xrm-ms
  • %WINDIR%\scripttemp.ini
Miscellaneous
Searches for the following windows
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
  • '%WINDIR%\_temp03292026504799\7z.exe' x %WINDIR%\_temp03292026504799\KMSmini.7z -y -o%WINDIR%\_temp03292026504799
  • '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_temp03292026504799 >>%windir%\ScriptTemp.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...' (with hidden window)
  • '%WINDIR%\_temp03292026504799\7z.exe' x %WINDIR%\_temp03292026504799\KMSmini.7z -y -o%WINDIR%\_temp03292026504799' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_temp03292026504799\ScriptDir.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_temp03292026504799\ScriptDir.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_temp03292026504799\ScriptDir.ini' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini
  • '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_temp03292026504799 >>%windir%\ScriptTemp.ini
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"
  • '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="HEU_KMS_Activator"
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_temp03292026504799\ScriptDir.ini
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_temp03292026504799\ScriptDir.ini
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_temp03292026504799\ScriptDir.ini

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android