Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrkika.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemphwmd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhkzyh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgasos.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlsgth.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembioyo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwkjuk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhgchn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempakvj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsuuof.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemctxtn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhtzdh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrusmy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemobsdu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemreawf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkcyrp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemanojn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemivboj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvycnw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnvzft.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkzjgc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcvxvf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkmhii.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvixop.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemicjaz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqqnha.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdrczb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqnewc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnkblr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvcnvu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxsdmg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemevjxp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmcwbk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtrxgl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemouyfy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtimxt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembiywv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzfxbr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwpcqq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempkcpv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwymlw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeyaim.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwgxss.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuqbew.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhkiqw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmeidw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfltcw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkxrvm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlwipb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemknnie.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemijyjg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzmbnm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvcjtr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemamqmr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemoilko.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwlkzi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembugyf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgxvyq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdoyiz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtlynm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembslri.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\Sysqemphwmd.exe'
- '%TEMP%\Sysqemhkzyh.exe'
- '%TEMP%\Sysqemhgchn.exe'
- '%TEMP%\Sysqemrkika.exe'
- '%TEMP%\Sysqembioyo.exe'
- '%TEMP%\Sysqemwkjuk.exe'
- '%TEMP%\Sysqemgasos.exe'
- '%TEMP%\Sysqemrusmy.exe'
- '%TEMP%\Sysqemsuuof.exe'
- '%TEMP%\Sysqemctxtn.exe'
- '%TEMP%\Sysqemxsdmg.exe'
- '%TEMP%\Sysqempakvj.exe'
- '%TEMP%\Sysqemobsdu.exe'
- '%TEMP%\Sysqemreawf.exe'
- '%TEMP%\Sysqemhtzdh.exe'
- '%TEMP%\Sysqemanojn.exe'
- '%TEMP%\Sysqemivboj.exe'
- '%TEMP%\Sysqemkmhii.exe'
- '%TEMP%\Sysqemkcyrp.exe'
- '%TEMP%\Sysqemkzjgc.exe'
- '%TEMP%\Sysqemcvxvf.exe'
- '%TEMP%\Sysqemvycnw.exe'
- '%TEMP%\Sysqemqnewc.exe'
- '%TEMP%\Sysqemicjaz.exe'
- '%TEMP%\Sysqemqqnha.exe'
- '%TEMP%\Sysqemlsgth.exe'
- '%TEMP%\Sysqemvixop.exe'
- '%TEMP%\Sysqemnkblr.exe'
- '%TEMP%\Sysqemvcnvu.exe'
- '%TEMP%\Sysqemdrczb.exe'
- '%TEMP%\Sysqemevjxp.exe'
- '%TEMP%\Sysqemmcwbk.exe'
- '%TEMP%\Sysqemtrxgl.exe'
- '%TEMP%\Sysqemouyfy.exe'
- '%TEMP%\Sysqemtimxt.exe'
- '%TEMP%\Sysqembiywv.exe'
- '%TEMP%\Sysqemzfxbr.exe'
- '%TEMP%\Sysqemwpcqq.exe'
- '%TEMP%\Sysqempkcpv.exe'
- '%TEMP%\Sysqemwymlw.exe'
- '%TEMP%\Sysqemeyaim.exe'
- '%TEMP%\Sysqemwgxss.exe'
- '%TEMP%\Sysqemuqbew.exe'
- '%TEMP%\Sysqemhkiqw.exe'
- '%TEMP%\Sysqemmeidw.exe'
- '%TEMP%\Sysqemfltcw.exe'
- '%TEMP%\Sysqemkxrvm.exe'
- '%TEMP%\Sysqemlwipb.exe'
- '%TEMP%\Sysqemknnie.exe'
- '%TEMP%\Sysqemijyjg.exe'
- '%TEMP%\Sysqemzmbnm.exe'
- '%TEMP%\Sysqemvcjtr.exe'
- '%TEMP%\Sysqemamqmr.exe'
- '%TEMP%\Sysqemoilko.exe'
- '%TEMP%\Sysqemwlkzi.exe'
- '%TEMP%\Sysqembugyf.exe'
- '%TEMP%\Sysqemgxvyq.exe'
- '%TEMP%\Sysqemdoyiz.exe'
- '%TEMP%\Sysqemtlynm.exe'
- '%TEMP%\Sysqembslri.exe'
Modifies file system :
Creates the following files:
- %TEMP%\Sysqemphwmd.exe
- %TEMP%\Sysqemhkzyh.exe
- %TEMP%\Sysqemhgchn.exe
- %TEMP%\Sysqemrkika.exe
- %TEMP%\Sysqembioyo.exe
- %TEMP%\Sysqemwkjuk.exe
- %TEMP%\Sysqemgasos.exe
- %TEMP%\Sysqemrusmy.exe
- %TEMP%\Sysqemsuuof.exe
- %TEMP%\Sysqemctxtn.exe
- %TEMP%\Sysqemxsdmg.exe
- %TEMP%\Sysqempakvj.exe
- %TEMP%\Sysqemobsdu.exe
- %TEMP%\Sysqemreawf.exe
- %TEMP%\Sysqemhtzdh.exe
- %TEMP%\Sysqemlsgth.exe
- %TEMP%\Sysqemkcyrp.exe
- %TEMP%\Sysqemanojn.exe
- %TEMP%\Sysqemivboj.exe
- %TEMP%\Sysqemvycnw.exe
- %TEMP%\Sysqemnvzft.exe
- %TEMP%\Sysqemkzjgc.exe
- %TEMP%\Sysqemcvxvf.exe
- %TEMP%\Sysqemkmhii.exe
- %TEMP%\Sysqemvixop.exe
- %TEMP%\Sysqemicjaz.exe
- %TEMP%\Sysqemqqnha.exe
- %TEMP%\Sysqemdrczb.exe
- %TEMP%\Sysqemqnewc.exe
- %TEMP%\Sysqemnkblr.exe
- %TEMP%\Sysqemvcnvu.exe
- %TEMP%\Sysqemijyjg.exe
- %TEMP%\Sysqemtrxgl.exe
- %TEMP%\Sysqemwpcqq.exe
- %TEMP%\Sysqemuqbew.exe
- %TEMP%\Sysqemmcwbk.exe
- %TEMP%\Sysqemzfxbr.exe
- %TEMP%\Sysqemouyfy.exe
- %TEMP%\Sysqemevjxp.exe
- %TEMP%\Sysqemhkiqw.exe
- %TEMP%\Sysqemeyaim.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\qpath.ini
- %TEMP%\Sysqemwymlw.exe
- %TEMP%\Sysqemmeidw.exe
- %TEMP%\Sysqemwgxss.exe
- %TEMP%\Sysqempkcpv.exe
- %TEMP%\Sysqembiywv.exe
- %TEMP%\Sysqemkxrvm.exe
- %TEMP%\Sysqemlwipb.exe
- %TEMP%\Sysqemamqmr.exe
- %TEMP%\Sysqemfltcw.exe
- %TEMP%\Sysqemzmbnm.exe
- %TEMP%\Sysqemvcjtr.exe
- %TEMP%\Sysqemknnie.exe
- %TEMP%\Sysqemdoyiz.exe
- %TEMP%\Sysqemwlkzi.exe
- %TEMP%\Sysqembugyf.exe
- %TEMP%\Sysqemtimxt.exe
- %TEMP%\Sysqemoilko.exe
- %TEMP%\Sysqemtlynm.exe
- %TEMP%\Sysqembslri.exe
- %TEMP%\Sysqemgxvyq.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\Sysqemphwmd.exe
- %TEMP%\Sysqemhkzyh.exe
- %TEMP%\Sysqemhgchn.exe
- %TEMP%\Sysqemrkika.exe
- %TEMP%\Sysqembioyo.exe
- %TEMP%\Sysqemwkjuk.exe
- %TEMP%\Sysqemgasos.exe
- %TEMP%\Sysqemrusmy.exe
- %TEMP%\Sysqemsuuof.exe
- %TEMP%\Sysqemctxtn.exe
- %TEMP%\Sysqemxsdmg.exe
- %TEMP%\Sysqempakvj.exe
- %TEMP%\Sysqemobsdu.exe
- %TEMP%\Sysqemreawf.exe
- %TEMP%\Sysqemhtzdh.exe
- %TEMP%\Sysqemlsgth.exe
- %TEMP%\Sysqemkcyrp.exe
- %TEMP%\Sysqemanojn.exe
- %TEMP%\Sysqemivboj.exe
- %TEMP%\Sysqemvycnw.exe
- %TEMP%\Sysqemnvzft.exe
- %TEMP%\Sysqemkzjgc.exe
- %TEMP%\Sysqemcvxvf.exe
- %TEMP%\Sysqemkmhii.exe
- %TEMP%\Sysqemvixop.exe
- %TEMP%\Sysqemicjaz.exe
- %TEMP%\Sysqemqqnha.exe
- %TEMP%\Sysqemdrczb.exe
- %TEMP%\Sysqemqnewc.exe
- %TEMP%\Sysqemnkblr.exe
- %TEMP%\Sysqemvcnvu.exe
- %TEMP%\Sysqemmcwbk.exe
- %TEMP%\Sysqemtrxgl.exe
- %TEMP%\Sysqemwpcqq.exe
- %TEMP%\Sysqemevjxp.exe
- %TEMP%\Sysqembiywv.exe
- %TEMP%\Sysqemzfxbr.exe
- %TEMP%\Sysqemouyfy.exe
- %TEMP%\Sysqemuqbew.exe
- %TEMP%\Sysqemwymlw.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemeyaim.exe
- %TEMP%\Sysqempkcpv.exe
- %TEMP%\Sysqemhkiqw.exe
- %TEMP%\Sysqemmeidw.exe
- %TEMP%\Sysqemwgxss.exe
- %TEMP%\Sysqemtimxt.exe
- %TEMP%\Sysqemfltcw.exe
- %TEMP%\Sysqemkxrvm.exe
- %TEMP%\Sysqemlwipb.exe
- %TEMP%\Sysqemknnie.exe
- %TEMP%\Sysqemijyjg.exe
- %TEMP%\Sysqemzmbnm.exe
- %TEMP%\Sysqemvcjtr.exe
- %TEMP%\Sysqemamqmr.exe
- %TEMP%\Sysqemoilko.exe
- %TEMP%\Sysqemwlkzi.exe
- %TEMP%\Sysqembugyf.exe
- %TEMP%\Sysqemgxvyq.exe
- %TEMP%\Sysqemdoyiz.exe
- %TEMP%\Sysqemtlynm.exe
- %TEMP%\Sysqembslri.exe
