Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'
- hidden files
- file extensions
- User Account Control (UAC)
- '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
- '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\fKkcgEEc.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=3800
- '<SYSTEM32>\reg.exe' /pid=6048
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\XuQwoIwA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\IqwQMoog.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=6112
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\EGosEUoQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=2420
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\iEIssQAo.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /c ""%TEMP%\dQUwwgkE.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2436
- '<SYSTEM32>\reg.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\taAocAwY.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\BAUAIwYw.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\eOQYsIIc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\TaoUocQQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\YwgQIkMQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\DOQwgwAc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\OuEUsEUk.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZocYMcQI.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\kGcwYAoE.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\rCUQIsIw.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\cgEIsIYg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZoYkwcwo.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tAUUYEcw.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\JuggscMo.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\psksUUso.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=5720
- '<SYSTEM32>\cscript.exe' /pid=5328
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\kakoosUY.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=5420
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PAYQwIEU.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=5960
- '<SYSTEM32>\cscript.exe' /pid=5984
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZMckIskk.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=6096
- '<SYSTEM32>\reg.exe' /pid=764
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RIUYoEMU.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=4380
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\CYcwsggs.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=4304
- '<SYSTEM32>\reg.exe' /pid=3956
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Megwkkkg.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=2840
- '<SYSTEM32>\reg.exe' /pid=4448
- '<SYSTEM32>\reg.exe' /pid=4696
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\QUgkocEE.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3836
- '<SYSTEM32>\cscript.exe' /pid=4532
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PeYwQQgw.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MYoEcskA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ausYIQos.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2636
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\yIUggUQo.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\USUcIsUg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\jIYIQEAQ.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2496
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\hgAoIgcY.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3044
- '<SYSTEM32>\reg.exe' /pid=2700
- '<SYSTEM32>\reg.exe' %TEMP%\file.vbs
- '<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\QSIQoggM.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\lUwYUogE.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\bKYIIwMk.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\TokgIAIg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AwAYEUwc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\NeAwEwkI.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\xWkwEIsg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\vWgcUIAM.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\SSUYggEc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AAcoosoU.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=1524
- '<SYSTEM32>\reg.exe' /pid=2748
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\PuIEkUgA.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2444
- '<SYSTEM32>\cscript.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cscript.exe' /c "<Current directory>\<Virus name>"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\roAIQoYc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\DwkMQMkM.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=968
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\DwUYAUEo.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3332
- '<SYSTEM32>\reg.exe' /pid=2676
- '<SYSTEM32>\cscript.exe'
- '<SYSTEM32>\reg.exe' /pid=3572
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FUwUQgsQ.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2984
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AgAQkoMA.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /c "<Current directory>\<Virus name>"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\wMoIwgcU.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' /pid=2660
- '<SYSTEM32>\reg.exe' /pid=2936
- '<SYSTEM32>\cscript.exe' /pid=3124
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\JscokcIg.bat" "<Full path to virus>""
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\reg.exe
- C:\RCX34.tmp
- <Current directory>\bwck.ico
- <Current directory>\mEEC.exe
- C:\RCX33.tmp
- <Current directory>\tUgI.ico
- <Current directory>\FMQa.exe
- %TEMP%\Megwkkkg.bat
- C:\RCX36.tmp
- <Current directory>\Cssi.exe
- C:\RCX35.tmp
- <Current directory>\xAAi.ico
- <Current directory>\ZwsK.exe
- <Current directory>\fckK.ico
- <Current directory>\Qskq.exe
- C:\RCX30.tmp
- %TEMP%\iEIssQAo.bat
- <Current directory>\cYwi.exe
- C:\RCX31.tmp
- C:\RCX32.tmp
- <Current directory>\ggkc.ico
- <Current directory>\HsMa.exe
- <Current directory>\BUoC.ico
- %TEMP%\YcYwYocA.bat
- <Current directory>\gokG.ico
- <Current directory>\KUkg.exe
- C:\RCX3A.tmp
- <Current directory>\AYUc.ico
- <Current directory>\WAUq.exe
- C:\RCX3B.tmp
- C:\RCX3C.tmp
- %TEMP%\eAEgEYoM.bat
- <Current directory>\NkEg.exe
- %TEMP%\PeYwQQgw.bat
- <Current directory>\wMsM.ico
- %TEMP%\XAQQwkgQ.bat
- C:\RCX37.tmp
- <Current directory>\LEkE.ico
- <Current directory>\asge.exe
- %TEMP%\QWkIsMQM.bat
- <Current directory>\GIwg.ico
- <Current directory>\wgcw.exe
- <Current directory>\TcwY.exe
- C:\RCX39.tmp
- <Current directory>\fcAy.ico
- C:\RCX38.tmp
- %TEMP%\CYcwsggs.bat
- <Current directory>\iAAC.ico
- <Current directory>\vwEs.exe
- %TEMP%\NEYMAMUY.bat
- <Current directory>\dEYM.exe
- C:\RCX26.tmp
- C:\RCX27.tmp
- %TEMP%\dQUwwgkE.bat
- <Current directory>\ewMG.ico
- C:\RCX28.tmp
- <Current directory>\KsQk.ico
- <Current directory>\uYMk.exe
- <Current directory>\foAs.ico
- C:\RCX23.tmp
- <Current directory>\rgci.ico
- <Current directory>\LooO.exe
- C:\RCX22.tmp
- <Current directory>\PIYI.ico
- <Current directory>\ZsMG.exe
- C:\RCX25.tmp
- %TEMP%\fKkcgEEc.bat
- <Current directory>\zMIO.exe
- C:\RCX24.tmp
- <Current directory>\HYMo.ico
- C:\RCX2D.tmp
- <Current directory>\voQy.ico
- %TEMP%\IsUQcccM.bat
- <Current directory>\tkEy.ico
- <Current directory>\Zwog.exe
- <Current directory>\okMe.exe
- C:\RCX2F.tmp
- <Current directory>\ycwQ.ico
- <Current directory>\zgIW.exe
- C:\RCX2E.tmp
- <Current directory>\ocUu.ico
- %TEMP%\EGosEUoQ.bat
- C:\RCX2A.tmp
- %TEMP%\nesIowYQ.bat
- <Current directory>\XsUk.ico
- <Current directory>\UMEo.exe
- C:\RCX29.tmp
- <Current directory>\zEcG.ico
- <Current directory>\bccw.exe
- C:\RCX2C.tmp
- <Current directory>\Wwsu.ico
- <Current directory>\XsoM.exe
- C:\RCX2B.tmp
- <Current directory>\SEEk.ico
- <Current directory>\PEsc.exe
- %TEMP%\mEMsccMA.bat
- <Current directory>\FgAW.exe
- C:\RCX4D.tmp
- C:\RCX4E.tmp
- <Current directory>\YEsU.ico
- <Current directory>\aMIi.exe
- C:\RCX4F.tmp
- <Current directory>\lEkQ.ico
- <Current directory>\QEUg.exe
- <Current directory>\iwAA.ico
- %TEMP%\QiYUMQMI.bat
- <Current directory>\Posc.ico
- C:\RCX4A.tmp
- <Current directory>\Vgsc.ico
- <Current directory>\LMIE.exe
- <Current directory>\XYoq.exe
- C:\RCX4C.tmp
- %TEMP%\psksUUso.bat
- <Current directory>\MwQc.exe
- C:\RCX4B.tmp
- <Current directory>\GYkw.ico
- %TEMP%\PAYQwIEU.bat
- <Current directory>\TAEc.ico
- C:\RCX54.tmp
- <Current directory>\Voks.ico
- <Current directory>\Soks.exe
- <Current directory>\JQIA.exe
- <Current directory>\lsss.exe
- C:\RCX56.tmp
- <Current directory>\iYEW.ico
- C:\RCX55.tmp
- %TEMP%\ewogwMco.bat
- C:\RCX53.tmp
- C:\RCX51.tmp
- <Current directory>\tEAm.ico
- <Current directory>\lIUM.exe
- C:\RCX50.tmp
- <Current directory>\uwcY.ico
- <Current directory>\jAcQ.exe
- <Current directory>\hoAK.ico
- <Current directory>\xYIG.exe
- %TEMP%\ZMckIskk.bat
- C:\RCX52.tmp
- %TEMP%\wksgsoIo.bat
- <Current directory>\XwIg.exe
- C:\RCX41.tmp
- <Current directory>\QAsI.ico
- <Current directory>\fkkM.exe
- C:\RCX40.tmp
- <Current directory>\iMEk.ico
- <Current directory>\lQMs.ico
- <Current directory>\ZQgC.exe
- C:\RCX42.tmp
- <Current directory>\Nocc.exe
- %TEMP%\RIUYoEMU.bat
- <Current directory>\ukYi.ico
- <Current directory>\aAgk.ico
- <Current directory>\oUQu.exe
- C:\RCX3D.tmp
- <Current directory>\oIMG.ico
- <Current directory>\VEUk.exe
- C:\RCX3E.tmp
- C:\RCX3F.tmp
- %TEMP%\eCswQwIg.bat
- <Current directory>\HYkQ.exe
- %TEMP%\QUgkocEE.bat
- <Current directory>\nUwk.ico
- %TEMP%\kqoYcoEc.bat
- <Current directory>\Ewco.ico
- C:\RCX47.tmp
- <Current directory>\kMEa.ico
- <Current directory>\zcMC.exe
- <Current directory>\oIcW.exe
- C:\RCX49.tmp
- %TEMP%\JuggscMo.bat
- <Current directory>\kEQo.exe
- C:\RCX48.tmp
- <Current directory>\VQMK.ico
- C:\RCX46.tmp
- <Current directory>\WosS.exe
- C:\RCX44.tmp
- <Current directory>\Asoo.ico
- C:\RCX43.tmp
- %TEMP%\JOcksgww.bat
- <Current directory>\ewUk.ico
- <Current directory>\vYUm.exe
- %TEMP%\kakoosUY.bat
- <Current directory>\lcQI.ico
- <Current directory>\isYk.exe
- C:\RCX45.tmp
- <Current directory>\MIUw.exe
- C:\RCX4.tmp
- <Current directory>\PwIY.ico
- %TEMP%\rswcQUQI.bat
- <Current directory>\HkMQ.ico
- <Current directory>\yksy.exe
- <Current directory>\lcIQ.exe
- C:\RCX6.tmp
- %TEMP%\roAIQoYc.bat
- <Current directory>\mMsa.exe
- C:\RCX5.tmp
- <Current directory>\YkYM.ico
- %TEMP%\DwUYAUEo.bat
- %TEMP%\YuMEsogU.bat
- C:\RCX1.tmp
- <Current directory>\qQgm.exe
- %TEMP%\AAcoosoU.bat
- <Current directory>\EMUa.ico
- <Current directory>\egAw.ico
- <Current directory>\vEQE.exe
- C:\RCX3.tmp
- <Current directory>\ZkAc.ico
- <Current directory>\sQsA.exe
- C:\RCX2.tmp
- <Current directory>\Hwcs.ico
- <Current directory>\HIMA.exe
- C:\RCXA.tmp
- <Current directory>\rYYQ.ico
- <Current directory>\CEAS.exe
- C:\RCXB.tmp
- C:\RCXC.tmp
- <Current directory>\kkEO.ico
- <Current directory>\qcQQ.exe
- %TEMP%\YwgQIkMQ.bat
- <Current directory>\moYu.ico
- %TEMP%\aEksAkgw.bat
- C:\RCX7.tmp
- <Current directory>\uMck.ico
- %TEMP%\RGgcosUM.bat
- <Current directory>\HkEq.ico
- <Current directory>\qMki.exe
- <Current directory>\KUAk.exe
- %TEMP%\DwkMQMkM.bat
- C:\RCX9.tmp
- <Current directory>\iscy.exe
- C:\RCX8.tmp
- <Current directory>\OwcM.ico
- %TEMP%\LYsEgQMs.bat
- %TEMP%\AwAYEUwc.bat
- %TEMP%\TokgIAIg.bat
- %TEMP%\SSUYggEc.bat
- %TEMP%\CKooIQsE.bat
- %TEMP%\ocIcQUkg.bat
- %TEMP%\uwgYgoYg.bat
- %TEMP%\yIUggUQo.bat
- %TEMP%\QSIQoggM.bat
- %TEMP%\boAkkgMA.bat
- %TEMP%\NeAwEwkI.bat
- %TEMP%\FosUQsII.bat
- %TEMP%\lUwYUogE.bat
- %TEMP%\jgAUgMYU.bat
- <Current directory>\<Virus name>
- %TEMP%\uyIscgoY.bat
- %TEMP%\file.vbs
- %TEMP%\jUsQAAsg.bat
- %TEMP%\vWgcUIAM.bat
- %TEMP%\xWkwEIsg.bat
- %TEMP%\bKYIIwMk.bat
- %TEMP%\KqAIYsgo.bat
- %TEMP%\FUwUQgsQ.bat
- %TEMP%\luIcQcUE.bat
- %TEMP%\scQooAcc.bat
- %TEMP%\uGYIMssA.bat
- %TEMP%\AgAQkoMA.bat
- %TEMP%\iSEksIwA.bat
- %TEMP%\PuIEkUgA.bat
- %TEMP%\PywkUMAk.bat
- %TEMP%\EagAUogA.bat
- %TEMP%\JscokcIg.bat
- %TEMP%\wMoIwgcU.bat
- %TEMP%\hgAoIgcY.bat
- %TEMP%\USUcIsUg.bat
- %TEMP%\imkUAUoc.bat
- %TEMP%\jIYIQEAQ.bat
- %TEMP%\DKUMocYU.bat
- %TEMP%\esAcUgcc.bat
- %TEMP%\MYoEcskA.bat
- %TEMP%\bUYQsEoE.bat
- %TEMP%\pMYIgQgM.bat
- %TEMP%\oqsQogEg.bat
- %TEMP%\joAcgYcU.bat
- %TEMP%\ausYIQos.bat
- <Current directory>\dAkK.exe
- %TEMP%\RAkMMAQc.bat
- <Current directory>\oAou.ico
- C:\RCX19.tmp
- %TEMP%\rCUQIsIw.bat
- C:\RCX1A.tmp
- %TEMP%\eQQEMcYg.bat
- C:\RCX1B.tmp
- <Current directory>\YIwy.exe
- %TEMP%\taAocAwY.bat
- <Current directory>\RsAc.ico
- <Current directory>\EMQG.exe
- %TEMP%\kGcwYAoE.bat
- <Current directory>\VcgU.exe
- <Current directory>\dYcy.ico
- %TEMP%\ZocYMcQI.bat
- %TEMP%\jAQwUIEI.bat
- C:\RCX17.tmp
- %TEMP%\gwockIAI.bat
- <Current directory>\ckgo.ico
- C:\RCX18.tmp
- <Current directory>\ccYI.ico
- <Current directory>\RkYg.exe
- <Current directory>\hUsI.ico
- <Current directory>\ucIe.exe
- %TEMP%\IqwQMoog.bat
- <Current directory>\NAEE.exe
- C:\RCX1F.tmp
- C:\RCX20.tmp
- %TEMP%\YcsAoMAQ.bat
- <Current directory>\iwEg.ico
- C:\RCX21.tmp
- <Current directory>\dMsw.ico
- <Current directory>\wMYM.exe
- <Current directory>\uUEQ.ico
- <Current directory>\CsAi.ico
- <Current directory>\DoIe.exe
- C:\RCX1C.tmp
- <Current directory>\yAAg.ico
- <Current directory>\AIsg.exe
- C:\RCX1D.tmp
- %TEMP%\XuQwoIwA.bat
- %TEMP%\gSEsgsUI.bat
- C:\RCX1E.tmp
- <Current directory>\hUIA.ico
- <Current directory>\oMIY.exe
- <Current directory>\cYAq.ico
- <Current directory>\tsIs.exe
- C:\RCX11.tmp
- <Current directory>\IUgg.ico
- <Current directory>\SQQA.exe
- C:\RCX12.tmp
- %TEMP%\DOQwgwAc.bat
- <Current directory>\EIgU.ico
- C:\RCX13.tmp
- <Current directory>\RkUg.ico
- <Current directory>\qQAI.exe
- C:\RCX10.tmp
- <Current directory>\AwIA.exe
- C:\RCXE.tmp
- <Current directory>\Pcgw.ico
- <Current directory>\hoYg.exe
- C:\RCXD.tmp
- %TEMP%\YacYQAgg.bat
- <Current directory>\vYgE.ico
- <Current directory>\lsQG.exe
- C:\RCXF.tmp
- <Current directory>\GAos.ico
- <Current directory>\mUcQ.exe
- %TEMP%\TaoUocQQ.bat
- %TEMP%\BAMQEgUY.bat
- %TEMP%\AEQMAIYU.bat
- %TEMP%\NgAwkYIo.bat
- %TEMP%\eOQYsIIc.bat
- %TEMP%\cgEIsIYg.bat
- %TEMP%\tAUUYEcw.bat
- %TEMP%\gAowgMoY.bat
- %TEMP%\EysAYEEg.bat
- %TEMP%\vKYwcYcQ.bat
- %TEMP%\ZoYkwcwo.bat
- %TEMP%\BAUAIwYw.bat
- <Current directory>\VoIE.ico
- <Current directory>\sEAU.exe
- %TEMP%\kWAIokMU.bat
- <Current directory>\RcYy.exe
- C:\RCX14.tmp
- C:\RCX15.tmp
- %TEMP%\OuEUsEUk.bat
- %TEMP%\yYggEAIM.bat
- C:\RCX16.tmp
- <Current directory>\YkUm.ico
- <Current directory>\XogE.exe
- %ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
- %HOMEPATH%\fCkYUMIQ\pUccUkoM.exe
- <Current directory>\bwck.ico
- <Current directory>\FMQa.exe
- <Current directory>\tUgI.ico
- <Current directory>\Cssi.exe
- <Current directory>\asge.exe
- %TEMP%\QWkIsMQM.bat
- <Current directory>\xAAi.ico
- %TEMP%\EGosEUoQ.bat
- <Current directory>\BUoC.ico
- <Current directory>\HsMa.exe
- %TEMP%\YcYwYocA.bat
- <Current directory>\mEEC.exe
- <Current directory>\ggkc.ico
- <Current directory>\ZwsK.exe
- <Current directory>\KUkg.exe
- <Current directory>\AYUc.ico
- <Current directory>\WAUq.exe
- <Current directory>\gokG.ico
- <Current directory>\VEUk.exe
- <Current directory>\wMsM.ico
- <Current directory>\NkEg.exe
- <Current directory>\LEkE.ico
- <Current directory>\wgcw.exe
- <Current directory>\GIwg.ico
- %TEMP%\iEIssQAo.bat
- %TEMP%\XAQQwkgQ.bat
- <Current directory>\fcAy.ico
- <Current directory>\TcwY.exe
- <Current directory>\ewMG.ico
- <Current directory>\UMEo.exe
- <Current directory>\KsQk.ico
- <Current directory>\XsUk.ico
- <Current directory>\zEcG.ico
- <Current directory>\XsoM.exe
- %TEMP%\nesIowYQ.bat
- <Current directory>\foAs.ico
- <Current directory>\dEYM.exe
- <Current directory>\HYMo.ico
- %TEMP%\NEYMAMUY.bat
- <Current directory>\uYMk.exe
- <Current directory>\iAAC.ico
- <Current directory>\vwEs.exe
- <Current directory>\ocUu.ico
- <Current directory>\zgIW.exe
- %TEMP%\dQUwwgkE.bat
- <Current directory>\cYwi.exe
- <Current directory>\fckK.ico
- <Current directory>\Qskq.exe
- <Current directory>\ycwQ.ico
- <Current directory>\Zwog.exe
- <Current directory>\Wwsu.ico
- <Current directory>\bccw.exe
- <Current directory>\tkEy.ico
- <Current directory>\voQy.ico
- <Current directory>\okMe.exe
- %TEMP%\IsUQcccM.bat
- %TEMP%\eAEgEYoM.bat
- <Current directory>\iwAA.ico
- <Current directory>\FgAW.exe
- <Current directory>\GYkw.ico
- <Current directory>\PEsc.exe
- <Current directory>\QEUg.exe
- %TEMP%\mEMsccMA.bat
- <Current directory>\SEEk.ico
- <Current directory>\Vgsc.ico
- <Current directory>\LMIE.exe
- <Current directory>\VQMK.ico
- <Current directory>\XYoq.exe
- <Current directory>\MwQc.exe
- %TEMP%\QiYUMQMI.bat
- <Current directory>\Posc.ico
- <Current directory>\hoAK.ico
- <Current directory>\xYIG.exe
- %TEMP%\wksgsoIo.bat
- <Current directory>\Soks.exe
- <Current directory>\TAEc.ico
- <Current directory>\JQIA.exe
- <Current directory>\Voks.ico
- <Current directory>\YEsU.ico
- <Current directory>\aMIi.exe
- <Current directory>\lEkQ.ico
- <Current directory>\lIUM.exe
- <Current directory>\tEAm.ico
- <Current directory>\jAcQ.exe
- <Current directory>\uwcY.ico
- <Current directory>\XwIg.exe
- %TEMP%\eCswQwIg.bat
- <Current directory>\ukYi.ico
- <Current directory>\QAsI.ico
- <Current directory>\ZQgC.exe
- <Current directory>\iMEk.ico
- <Current directory>\Nocc.exe
- <Current directory>\aAgk.ico
- <Current directory>\oUQu.exe
- <Current directory>\oIMG.ico
- %TEMP%\CYcwsggs.bat
- <Current directory>\fkkM.exe
- <Current directory>\nUwk.ico
- <Current directory>\HYkQ.exe
- <Current directory>\kMEa.ico
- <Current directory>\zcMC.exe
- <Current directory>\lcQI.ico
- %TEMP%\kqoYcoEc.bat
- <Current directory>\kEQo.exe
- <Current directory>\Ewco.ico
- <Current directory>\oIcW.exe
- <Current directory>\Asoo.ico
- <Current directory>\WosS.exe
- <Current directory>\lQMs.ico
- %TEMP%\JOcksgww.bat
- <Current directory>\vYUm.exe
- <Current directory>\ewUk.ico
- <Current directory>\isYk.exe
- <Current directory>\zMIO.exe
- %TEMP%\PuIEkUgA.bat
- <Current directory>\YkYM.ico
- <Current directory>\mMsa.exe
- <Current directory>\qMki.exe
- <Current directory>\KUAk.exe
- %TEMP%\RGgcosUM.bat
- <Current directory>\HkEq.ico
- <Current directory>\yksy.exe
- <Current directory>\ZkAc.ico
- <Current directory>\vEQE.exe
- <Current directory>\HkMQ.ico
- <Current directory>\PwIY.ico
- <Current directory>\lcIQ.exe
- %TEMP%\rswcQUQI.bat
- <Current directory>\moYu.ico
- <Current directory>\qcQQ.exe
- <Current directory>\Hwcs.ico
- <Current directory>\hoYg.exe
- <Current directory>\Pcgw.ico
- <Current directory>\AwIA.exe
- <Current directory>\kkEO.ico
- <Current directory>\OwcM.ico
- <Current directory>\iscy.exe
- <Current directory>\uMck.ico
- <Current directory>\CEAS.exe
- <Current directory>\HIMA.exe
- %TEMP%\aEksAkgw.bat
- <Current directory>\rYYQ.ico
- %TEMP%\uwgYgoYg.bat
- %TEMP%\boAkkgMA.bat
- %TEMP%\ocIcQUkg.bat
- %TEMP%\DKUMocYU.bat
- %TEMP%\joAcgYcU.bat
- %TEMP%\imkUAUoc.bat
- %TEMP%\esAcUgcc.bat
- %TEMP%\KqAIYsgo.bat
- %TEMP%\jgAUgMYU.bat
- %TEMP%\uyIscgoY.bat
- %TEMP%\jUsQAAsg.bat
- %TEMP%\LYsEgQMs.bat
- %TEMP%\CKooIQsE.bat
- %TEMP%\FosUQsII.bat
- <Current directory>\qQgm.exe
- %TEMP%\PywkUMAk.bat
- %TEMP%\EagAUogA.bat
- <Current directory>\EMUa.ico
- <Current directory>\egAw.ico
- <Current directory>\sQsA.exe
- %TEMP%\YuMEsogU.bat
- %TEMP%\uGYIMssA.bat
- %TEMP%\pMYIgQgM.bat
- %TEMP%\oqsQogEg.bat
- %TEMP%\scQooAcc.bat
- %TEMP%\iSEksIwA.bat
- %TEMP%\bUYQsEoE.bat
- %TEMP%\luIcQcUE.bat
- <Current directory>\mUcQ.exe
- <Current directory>\yAAg.ico
- <Current directory>\AIsg.exe
- %TEMP%\eQQEMcYg.bat
- <Current directory>\DoIe.exe
- <Current directory>\hUIA.ico
- <Current directory>\oMIY.exe
- <Current directory>\CsAi.ico
- %TEMP%\RAkMMAQc.bat
- <Current directory>\ckgo.ico
- <Current directory>\EMQG.exe
- <Current directory>\dAkK.exe
- <Current directory>\RsAc.ico
- <Current directory>\YIwy.exe
- <Current directory>\oAou.ico
- <Current directory>\LooO.exe
- <Current directory>\iwEg.ico
- <Current directory>\MIUw.exe
- %TEMP%\YcsAoMAQ.bat
- <Current directory>\rgci.ico
- <Current directory>\ZsMG.exe
- <Current directory>\PIYI.ico
- <Current directory>\uUEQ.ico
- <Current directory>\NAEE.exe
- %TEMP%\gSEsgsUI.bat
- <Current directory>\ucIe.exe
- <Current directory>\dMsw.ico
- <Current directory>\wMYM.exe
- <Current directory>\hUsI.ico
- <Current directory>\RkUg.ico
- <Current directory>\qQAI.exe
- <Current directory>\cYAq.ico
- <Current directory>\RcYy.exe
- <Current directory>\VoIE.ico
- <Current directory>\sEAU.exe
- <Current directory>\EIgU.ico
- <Current directory>\vYgE.ico
- <Current directory>\lsQG.exe
- <Current directory>\GAos.ico
- %TEMP%\YacYQAgg.bat
- <Current directory>\tsIs.exe
- <Current directory>\IUgg.ico
- <Current directory>\SQQA.exe
- <Current directory>\VcgU.exe
- %TEMP%\jAQwUIEI.bat
- %TEMP%\gAowgMoY.bat
- <Current directory>\dYcy.ico
- %TEMP%\gwockIAI.bat
- <Current directory>\ccYI.ico
- <Current directory>\RkYg.exe
- %TEMP%\NgAwkYIo.bat
- %TEMP%\yYggEAIM.bat
- %TEMP%\kWAIokMU.bat
- %TEMP%\AEQMAIYU.bat
- %TEMP%\EysAYEEg.bat
- %TEMP%\vKYwcYcQ.bat
- %TEMP%\BAMQEgUY.bat
- from C:\RCX3A.tmp to <Current directory>\WAUq.exe
- from C:\RCX3B.tmp to <Current directory>\KUkg.exe
- from C:\RCX39.tmp to <Current directory>\TcwY.exe
- from C:\RCX37.tmp to <Current directory>\asge.exe
- from C:\RCX38.tmp to <Current directory>\wgcw.exe
- from C:\RCX3F.tmp to <Current directory>\HYkQ.exe
- from C:\RCX40.tmp to <Current directory>\fkkM.exe
- from C:\RCX3E.tmp to <Current directory>\oUQu.exe
- from C:\RCX3C.tmp to <Current directory>\NkEg.exe
- from C:\RCX3D.tmp to <Current directory>\VEUk.exe
- from C:\RCX36.tmp to <Current directory>\Cssi.exe
- from C:\RCX2F.tmp to <Current directory>\zgIW.exe
- from C:\RCX30.tmp to <Current directory>\cYwi.exe
- from C:\RCX2E.tmp to <Current directory>\okMe.exe
- from C:\RCX2C.tmp to <Current directory>\bccw.exe
- from C:\RCX2D.tmp to <Current directory>\Zwog.exe
- from C:\RCX34.tmp to <Current directory>\mEEC.exe
- from C:\RCX35.tmp to <Current directory>\FMQa.exe
- from C:\RCX33.tmp to <Current directory>\ZwsK.exe
- from C:\RCX31.tmp to <Current directory>\Qskq.exe
- from C:\RCX32.tmp to <Current directory>\HsMa.exe
- from C:\RCX4F.tmp to <Current directory>\QEUg.exe
- from C:\RCX50.tmp to <Current directory>\aMIi.exe
- from C:\RCX4E.tmp to <Current directory>\PEsc.exe
- from C:\RCX4C.tmp to <Current directory>\MwQc.exe
- from C:\RCX4D.tmp to <Current directory>\FgAW.exe
- from C:\RCX54.tmp to <Current directory>\Soks.exe
- from C:\RCX55.tmp to <Current directory>\JQIA.exe
- from C:\RCX53.tmp to <Current directory>\xYIG.exe
- from C:\RCX51.tmp to <Current directory>\lIUM.exe
- from C:\RCX52.tmp to <Current directory>\jAcQ.exe
- from C:\RCX4B.tmp to <Current directory>\XYoq.exe
- from C:\RCX44.tmp to <Current directory>\WosS.exe
- from C:\RCX45.tmp to <Current directory>\isYk.exe
- from C:\RCX43.tmp to <Current directory>\ZQgC.exe
- from C:\RCX41.tmp to <Current directory>\XwIg.exe
- from C:\RCX42.tmp to <Current directory>\Nocc.exe
- from C:\RCX49.tmp to <Current directory>\kEQo.exe
- from C:\RCX4A.tmp to <Current directory>\LMIE.exe
- from C:\RCX48.tmp to <Current directory>\oIcW.exe
- from C:\RCX46.tmp to <Current directory>\vYUm.exe
- from C:\RCX47.tmp to <Current directory>\zcMC.exe
- from C:\RCXF.tmp to <Current directory>\mUcQ.exe
- from C:\RCX10.tmp to <Current directory>\lsQG.exe
- from C:\RCXE.tmp to <Current directory>\AwIA.exe
- from C:\RCXC.tmp to <Current directory>\qcQQ.exe
- from C:\RCXD.tmp to <Current directory>\hoYg.exe
- from C:\RCX14.tmp to <Current directory>\RcYy.exe
- from C:\RCX15.tmp to <Current directory>\sEAU.exe
- from C:\RCX13.tmp to <Current directory>\qQAI.exe
- from C:\RCX11.tmp to <Current directory>\SQQA.exe
- from C:\RCX12.tmp to <Current directory>\tsIs.exe
- from C:\RCXB.tmp to <Current directory>\HIMA.exe
- from C:\RCX4.tmp to <Current directory>\yksy.exe
- from C:\RCX5.tmp to <Current directory>\lcIQ.exe
- from C:\RCX3.tmp to <Current directory>\vEQE.exe
- from C:\RCX1.tmp to <Current directory>\qQgm.exe
- from C:\RCX2.tmp to <Current directory>\sQsA.exe
- from C:\RCX9.tmp to <Current directory>\iscy.exe
- from C:\RCXA.tmp to <Current directory>\CEAS.exe
- from C:\RCX8.tmp to <Current directory>\KUAk.exe
- from C:\RCX6.tmp to <Current directory>\mMsa.exe
- from C:\RCX7.tmp to <Current directory>\qMki.exe
- from C:\RCX25.tmp to <Current directory>\zMIO.exe
- from C:\RCX26.tmp to <Current directory>\dEYM.exe
- from C:\RCX24.tmp to <Current directory>\ZsMG.exe
- from C:\RCX22.tmp to <Current directory>\MIUw.exe
- from C:\RCX23.tmp to <Current directory>\LooO.exe
- from C:\RCX2A.tmp to <Current directory>\DoIe.exe
- from C:\RCX2B.tmp to <Current directory>\XsoM.exe
- from C:\RCX29.tmp to <Current directory>\UMEo.exe
- from C:\RCX27.tmp to <Current directory>\vwEs.exe
- from C:\RCX28.tmp to <Current directory>\uYMk.exe
- from C:\RCX21.tmp to <Current directory>\wMYM.exe
- from C:\RCX1A.tmp to <Current directory>\dAkK.exe
- from C:\RCX1B.tmp to <Current directory>\YIwy.exe
- from C:\RCX19.tmp to <Current directory>\EMQG.exe
- from C:\RCX17.tmp to <Current directory>\VcgU.exe
- from C:\RCX18.tmp to <Current directory>\RkYg.exe
- from C:\RCX1F.tmp to <Current directory>\NAEE.exe
- from C:\RCX20.tmp to <Current directory>\ucIe.exe
- from C:\RCX1E.tmp to <Current directory>\oMIY.exe
- from C:\RCX1C.tmp to <Current directory>\AIsg.exe
- from C:\RCX1D.tmp to <Current directory>\DoIe.exe
- '20#.#19.204.12':666
- '19#.#86.45.170':666
- '74.##5.232.51':80
- '20#.#7.164.69':666
- '20#.#7.164.69':9999
- '20#.#19.204.12':9999
- '19#.#86.45.170':9999
- 74.##5.232.51/
- DNS ASK google.com
- ClassName: 'Indicator' WindowName: ''