Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtngls.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjsqvc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnaamo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgwbkw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemixvnv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxjufk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgihti.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqwkjv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjaexs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemokvtl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrkxzb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlnvbx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemolaab.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyzdjw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwdfwr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgziem.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnomqt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempbcej.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemncxkk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemszwlx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemasfjr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmaewm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemacwui.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuhjvh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzqoww.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsxhxm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyklqc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempyflz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqeminpub.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemilirl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfqrkb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcqgvj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvqrza.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwlvov.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvycxa.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhwgat.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyfsdo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvltdx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuzhah.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnniyp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqasyi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuvskf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempzvqo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrouiz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhmupi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhuojp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtuiqs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqzcqn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlztkg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemovrkp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzqydg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwjuez.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrpusz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeqwgv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfnvwj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembjfaz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrgzqx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzxtvk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzydzq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemaniiy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrjgqf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsezbn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfssph.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwelkv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemphiai.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxhnwz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkngkz.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\Sysqemtngls.exe'
- '%TEMP%\Sysqemjsqvc.exe'
- '%TEMP%\Sysqemnaamo.exe'
- '%TEMP%\Sysqemgwbkw.exe'
- '%TEMP%\Sysqemixvnv.exe'
- '%TEMP%\Sysqemxjufk.exe'
- '%TEMP%\Sysqemgihti.exe'
- '%TEMP%\Sysqemqwkjv.exe'
- '%TEMP%\Sysqemjaexs.exe'
- '%TEMP%\Sysqemokvtl.exe'
- '%TEMP%\Sysqemrkxzb.exe'
- '%TEMP%\Sysqemlnvbx.exe'
- '%TEMP%\Sysqemolaab.exe'
- '%TEMP%\Sysqemyzdjw.exe'
- '%TEMP%\Sysqemwdfwr.exe'
- '%TEMP%\Sysqemgziem.exe'
- '%TEMP%\Sysqemnomqt.exe'
- '%TEMP%\Sysqempbcej.exe'
- '%TEMP%\Sysqemncxkk.exe'
- '%TEMP%\Sysqemszwlx.exe'
- '%TEMP%\Sysqemasfjr.exe'
- '%TEMP%\Sysqemmaewm.exe'
- '%TEMP%\Sysqemacwui.exe'
- '%TEMP%\Sysqemuhjvh.exe'
- '%TEMP%\Sysqemzqoww.exe'
- '%TEMP%\Sysqemsxhxm.exe'
- '%TEMP%\Sysqemyklqc.exe'
- '%TEMP%\Sysqempyflz.exe'
- '%TEMP%\Sysqeminpub.exe'
- '%TEMP%\Sysqemilirl.exe'
- '%TEMP%\Sysqemfqrkb.exe'
- '%TEMP%\Sysqemcqgvj.exe'
- '%TEMP%\Sysqemvqrza.exe'
- '%TEMP%\Sysqemwlvov.exe'
- '%TEMP%\Sysqemvycxa.exe'
- '%TEMP%\Sysqemhwgat.exe'
- '%TEMP%\Sysqemyfsdo.exe'
- '%TEMP%\Sysqemvltdx.exe'
- '%TEMP%\Sysqemuzhah.exe'
- '%TEMP%\Sysqemnniyp.exe'
- '%TEMP%\Sysqemqasyi.exe'
- '%TEMP%\Sysqemuvskf.exe'
- '%TEMP%\Sysqempzvqo.exe'
- '%TEMP%\Sysqemrouiz.exe'
- '%TEMP%\Sysqemhmupi.exe'
- '%TEMP%\Sysqemhuojp.exe'
- '%TEMP%\Sysqemtuiqs.exe'
- '%TEMP%\Sysqemqzcqn.exe'
- '%TEMP%\Sysqemlztkg.exe'
- '%TEMP%\Sysqemovrkp.exe'
- '%TEMP%\Sysqemzqydg.exe'
- '%TEMP%\Sysqemwjuez.exe'
- '%TEMP%\Sysqemrpusz.exe'
- '%TEMP%\Sysqemeqwgv.exe'
- '%TEMP%\Sysqemfnvwj.exe'
- '%TEMP%\Sysqembjfaz.exe'
- '%TEMP%\Sysqemrgzqx.exe'
- '%TEMP%\Sysqemzxtvk.exe'
- '%TEMP%\Sysqemzydzq.exe'
- '%TEMP%\Sysqemaniiy.exe'
- '%TEMP%\Sysqemrjgqf.exe'
- '%TEMP%\Sysqemsezbn.exe'
- '%TEMP%\Sysqemfssph.exe'
- '%TEMP%\Sysqemwelkv.exe'
- '%TEMP%\Sysqemphiai.exe'
- '%TEMP%\Sysqemxhnwz.exe'
- '%TEMP%\Sysqemkngkz.exe'
Modifies file system :
Creates the following files:
- %TEMP%\Sysqemtngls.exe
- %TEMP%\Sysqemjsqvc.exe
- %TEMP%\Sysqemnaamo.exe
- %TEMP%\Sysqemgwbkw.exe
- %TEMP%\Sysqemixvnv.exe
- %TEMP%\Sysqemxjufk.exe
- %TEMP%\Sysqemgihti.exe
- %TEMP%\Sysqemqwkjv.exe
- %TEMP%\Sysqemyzdjw.exe
- %TEMP%\Sysqemlnvbx.exe
- %TEMP%\Sysqemjaexs.exe
- %TEMP%\Sysqemwlvov.exe
- %TEMP%\Sysqemrkxzb.exe
- %TEMP%\Sysqemgziem.exe
- %TEMP%\Sysqemolaab.exe
- %TEMP%\Sysqemokvtl.exe
- %TEMP%\Sysqemwdfwr.exe
- %TEMP%\Sysqempbcej.exe
- %TEMP%\Sysqemncxkk.exe
- %TEMP%\Sysqemszwlx.exe
- %TEMP%\Sysqemasfjr.exe
- %TEMP%\Sysqemmaewm.exe
- %TEMP%\Sysqemacwui.exe
- %TEMP%\Sysqemuhjvh.exe
- %TEMP%\Sysqemzqoww.exe
- %TEMP%\Sysqemfqrkb.exe
- %TEMP%\Sysqeminpub.exe
- %TEMP%\Sysqemsxhxm.exe
- %TEMP%\Sysqemnomqt.exe
- %TEMP%\Sysqempyflz.exe
- %TEMP%\Sysqemvqrza.exe
- %TEMP%\Sysqemilirl.exe
- %TEMP%\Sysqemyklqc.exe
- %TEMP%\Sysqemcqgvj.exe
- %TEMP%\Sysqemrgzqx.exe
- %TEMP%\Sysqemvltdx.exe
- %TEMP%\Sysqemvycxa.exe
- %TEMP%\Sysqemqzcqn.exe
- %TEMP%\Sysqemyfsdo.exe
- %TEMP%\Sysqemuvskf.exe
- %TEMP%\Sysqemuzhah.exe
- %TEMP%\Sysqemhwgat.exe
- %TEMP%\Sysqemqasyi.exe
- %TEMP%\Sysqemtuiqs.exe
- %TEMP%\Sysqemhmupi.exe
- %TEMP%\Sysqemhuojp.exe
- %TEMP%\qpath.ini
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemlztkg.exe
- %TEMP%\Sysqemovrkp.exe
- %TEMP%\Sysqempzvqo.exe
- %TEMP%\Sysqemrouiz.exe
- %TEMP%\Sysqemfnvwj.exe
- %TEMP%\Sysqemwjuez.exe
- %TEMP%\Sysqemphiai.exe
- %TEMP%\Sysqemeqwgv.exe
- %TEMP%\Sysqemzydzq.exe
- %TEMP%\Sysqembjfaz.exe
- %TEMP%\Sysqemrpusz.exe
- %TEMP%\Sysqemzxtvk.exe
- %TEMP%\Sysqemwelkv.exe
- %TEMP%\Sysqemsezbn.exe
- %TEMP%\Sysqemfssph.exe
- %TEMP%\Sysqemnniyp.exe
- %TEMP%\Sysqemzqydg.exe
- %TEMP%\Sysqemxhnwz.exe
- %TEMP%\Sysqemkngkz.exe
- %TEMP%\Sysqemaniiy.exe
- %TEMP%\Sysqemrjgqf.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\Sysqemtngls.exe
- %TEMP%\Sysqemjsqvc.exe
- %TEMP%\Sysqemnaamo.exe
- %TEMP%\Sysqemgwbkw.exe
- %TEMP%\Sysqemixvnv.exe
- %TEMP%\Sysqemxjufk.exe
- %TEMP%\Sysqemgihti.exe
- %TEMP%\Sysqemqwkjv.exe
- %TEMP%\Sysqemyzdjw.exe
- %TEMP%\Sysqemlnvbx.exe
- %TEMP%\Sysqemjaexs.exe
- %TEMP%\Sysqemwlvov.exe
- %TEMP%\Sysqemrkxzb.exe
- %TEMP%\Sysqemgziem.exe
- %TEMP%\Sysqemolaab.exe
- %TEMP%\Sysqemokvtl.exe
- %TEMP%\Sysqemwdfwr.exe
- %TEMP%\Sysqempbcej.exe
- %TEMP%\Sysqemncxkk.exe
- %TEMP%\Sysqemszwlx.exe
- %TEMP%\Sysqemasfjr.exe
- %TEMP%\Sysqemmaewm.exe
- %TEMP%\Sysqemacwui.exe
- %TEMP%\Sysqemuhjvh.exe
- %TEMP%\Sysqemzqoww.exe
- %TEMP%\Sysqemfqrkb.exe
- %TEMP%\Sysqeminpub.exe
- %TEMP%\Sysqemsxhxm.exe
- %TEMP%\Sysqemnomqt.exe
- %TEMP%\Sysqempyflz.exe
- %TEMP%\Sysqemvqrza.exe
- %TEMP%\Sysqemilirl.exe
- %TEMP%\Sysqemyklqc.exe
- %TEMP%\Sysqemcqgvj.exe
- %TEMP%\Sysqemvycxa.exe
- %TEMP%\Sysqemhwgat.exe
- %TEMP%\Sysqemyfsdo.exe
- %TEMP%\Sysqemvltdx.exe
- %TEMP%\Sysqemuzhah.exe
- %TEMP%\Sysqemnniyp.exe
- %TEMP%\Sysqemqasyi.exe
- %TEMP%\Sysqemuvskf.exe
- %TEMP%\Sysqemqzcqn.exe
- %TEMP%\Sysqemhuojp.exe
- %TEMP%\Sysqempzvqo.exe
- %TEMP%\Sysqemhmupi.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemovrkp.exe
- %TEMP%\Sysqemtuiqs.exe
- %TEMP%\Sysqemrouiz.exe
- %TEMP%\Sysqemlztkg.exe
- %TEMP%\Sysqemwjuez.exe
- %TEMP%\Sysqemrpusz.exe
- %TEMP%\Sysqemeqwgv.exe
- %TEMP%\Sysqemfnvwj.exe
- %TEMP%\Sysqembjfaz.exe
- %TEMP%\Sysqemrgzqx.exe
- %TEMP%\Sysqemzxtvk.exe
- %TEMP%\Sysqemzydzq.exe
- %TEMP%\Sysqemphiai.exe
- %TEMP%\Sysqemfssph.exe
- %TEMP%\Sysqemaniiy.exe
- %TEMP%\Sysqemzqydg.exe
- %TEMP%\Sysqemsezbn.exe
- %TEMP%\Sysqemkngkz.exe
- %TEMP%\Sysqemwelkv.exe
- %TEMP%\Sysqemrjgqf.exe
- %TEMP%\Sysqemxhnwz.exe
