Technical Information
Malicious functions
Injects code into
the following user processes:
- svchos~1.exe
Modifies file system
Creates the following files
- %TEMP%\amnocn6wh\a663btwuo.bat
- %TEMP%\amnocn6wh\product_sample_pdf.exe.344.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.366.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.365.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.364.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.363.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.362.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.361.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.360.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.36.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.359.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.358.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.357.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.356.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.355.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.354.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.353.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.352.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.351.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.350.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.35.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.349.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.348.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.347.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.367.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.346.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.369.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.37.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.38.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.39.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.389.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.388.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.387.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.386.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.385.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.384.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.383.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.382.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.381.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.380.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.379.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.33.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.378.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.377.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.376.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.375.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.374.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.373.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.372.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.371.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.370.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.368.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.345.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.343.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.342.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.317.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.314.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.313.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.312.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.311.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.310.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.31.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.309.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.308.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.307.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.306.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.305.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.304.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.303.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.302.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.301.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.300.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.30.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.3.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.299.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.298.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.297.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.296.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.315.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.318.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.340.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.32.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.341.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.319.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.34.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.339.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.338.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.337.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.336.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.335.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.334.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.333.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.332.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.295.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.331.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.330.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.329.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.328.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.327.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.326.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.325.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.324.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.323.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.322.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.321.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.320.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.390.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.316.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.391.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.414.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.75.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.74.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.73.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.72.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.71.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.70.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.7.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.69.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.68.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.67.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.66.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.65.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.64.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.63.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.62.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.61.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.60.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.6.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.59.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.58.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.57.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.56.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.55.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.53.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.54.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.76.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.77.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.99.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.98.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.97.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.96.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.95.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.94.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.93.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.92.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.91.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.90.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.9.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.88.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.51.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.87.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.86.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.85.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.84.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.83.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.82.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.81.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.80.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.8.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.79.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.78.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.52.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.50.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.230.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.415.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.412.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.411.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.410.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.41.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.409.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.408.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.407.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.406.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.405.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.404.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.403.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.402.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.401.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.400.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.40.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.4.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.399.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.398.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.397.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.396.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.395.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.394.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.416.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.417.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.5.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.428.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.429.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.49.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.48.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.47.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.46.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.45.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.44.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.432.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.431.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.430.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.43.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.393.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.392.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.413.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.426.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.425.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.424.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.423.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.422.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.421.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.420.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.42.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.419.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.418.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.427.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.294.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.293.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.292.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.147.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.167.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.166.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.165.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.164.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.163.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.162.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.161.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.160.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.16.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.159.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.158.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.157.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.156.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.155.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.154.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.153.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.152.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.151.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.150.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.15.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.149.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.148.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.17.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.169.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.171.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.146.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.191.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.190.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.19.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.189.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.188.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.187.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.186.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.185.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.184.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.183.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.182.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.180.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.194.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.18.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.179.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.178.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.177.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.176.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.175.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.174.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.173.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.172.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.170.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.192.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.145.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.144.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.118.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.116.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.115.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.114.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.113.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.112.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.111.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.110.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.11.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.109.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.108.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.107.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.106.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.105.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.104.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.103.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.102.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.101.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.100.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.10.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.1.part
- %TEMP%\amnocn6wh\aro71mqwr.vbs
- %TEMP%\amnocn6wh\product_sample_pdf.exe.119.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.12.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.120.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.117.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.121.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.142.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.143.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.141.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.140.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.14.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.139.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.138.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.137.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.136.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.135.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.134.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.193.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.181.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.133.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.130.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.13.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.129.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.128.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.127.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.126.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.125.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.124.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.123.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.122.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.132.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.131.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.168.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.195.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.266.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.268.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.265.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.264.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.263.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.262.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.261.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.260.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.26.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.259.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.258.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.257.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.256.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.255.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.254.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.253.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.252.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.251.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.250.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.25.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.249.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.248.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.247.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.246.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.269.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.27.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.291.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.280.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.281.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.290.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.29.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.289.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.288.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.287.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.286.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.285.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.284.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.283.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.282.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.267.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.245.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.196.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.279.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.278.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.277.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.276.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.275.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.274.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.273.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.272.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.271.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.270.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.28.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.89.part
- %TEMP%\amnocn6wh\uttnom68.bat
- %TEMP%\amnocn6wh\product_sample_pdf.exe.242.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.215.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.214.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.213.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.212.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.211.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.210.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.21.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.209.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.208.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.207.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.206.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.205.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.204.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.203.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.202.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.201.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.200.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.20.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.2.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.199.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.198.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.197.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.217.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.218.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.216.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.219.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.241.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.22.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.240.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.24.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.239.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.238.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.237.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.236.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.235.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.234.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.233.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.232.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.244.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.243.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.23.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.229.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.228.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.227.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.226.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.225.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.224.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.223.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.222.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.221.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.220.part
- %TEMP%\amnocn6wh\product_sample_pdf.exe.231.part
- %TEMP%\system\svchost.exe.exe
Moves the following files
- from %TEMP%\amnocn6wh\product_sample_pdf.exe.1.part to %TEMP%\amnocn6wh\amnocn6wh.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\amnocn6wh\amnocn6wh.exe'
- '%WINDIR%\syswow64\cmd.exe' /c A663btWUO.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wscript.exe' ARo71Mqwr.vbs
- '%WINDIR%\syswow64\cmd.exe' /c A663btWUO.bat
