Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'
- hidden files
- file extensions
- User Account Control (UAC)
- '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
- '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RokcgYAI.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\jCsYIMUc.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\zOoQcYQc.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3376
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CioocIYQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\IQQcMgAU.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\cWQEwIss.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\TwUQgEEM.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PysAYQYE.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\OsEskQYY.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe'
- '<SYSTEM32>\reg.exe' /pid=4024
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\Xawssows.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' /pid=2812
- '<SYSTEM32>\reg.exe' /pid=2744
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\QWYkcUEw.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\lIksIYUM.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=2604
- '<SYSTEM32>\reg.exe' /pid=2444
- '<SYSTEM32>\cscript.exe' /pid=4000
- '<SYSTEM32>\reg.exe' /R /T
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\LsggkMkk.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=4076
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AgkIUcwM.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=4152
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\BAIMswAQ.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3464
- '<SYSTEM32>\cscript.exe' /pid=3940
- '<SYSTEM32>\reg.exe' /pid=2488
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\NSkAAAUg.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\rUAUskoA.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\hcoAoEYo.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PUoIkEMY.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\geMsMsoc.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=6072
- '<SYSTEM32>\cscript.exe' /pid=6040
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\GAAYUkEk.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\bSYwEwsI.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CSoYYoEY.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /c "<Current directory>\<Virus name>"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RyUocMwQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\YYUUcEwE.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PKQwYwgo.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\OSYwEYgQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\hCocgAsA.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /c ""%TEMP%\RkIgwkQI.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3064
- '<SYSTEM32>\reg.exe' /pid=364
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CKcYwMAk.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\gKEAwQYs.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\UQMkIoQs.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\NyYUIsgc.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\JgIcYUoY.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\OOAkQIEs.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RkIYMQAQ.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\TUcMAIEI.bat" "<Full path to virus>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PgQQQcww.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3728
- '<SYSTEM32>\reg.exe' /pid=3980
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\bsEMIIwU.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3448
- '<SYSTEM32>\cscript.exe' /pid=2252
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\eooswYsU.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=3812
- '<SYSTEM32>\reg.exe' /c "<Current directory>\<Virus name>"
- '<SYSTEM32>\cscript.exe'
- '<SYSTEM32>\reg.exe' /pid=3160
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\VQEcEcgU.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=2780
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\uAMQIAEk.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=240
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\xSYwIEAs.bat" "<Full path to virus>""
- '<SYSTEM32>\cscript.exe' /pid=3300
- '<SYSTEM32>\cscript.exe' /pid=3564
- '<SYSTEM32>\reg.exe' %TEMP%\file.vbs
- '<SYSTEM32>\reg.exe' /pid=2720
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\reg.exe
- C:\RCX14.tmp
- <Current directory>\EYgO.exe
- %TEMP%\IQQcMgAU.bat
- <Current directory>\PUws.ico
- %TEMP%\kEkMcAEo.bat
- <Current directory>\Scco.ico
- %TEMP%\IkAsUcYw.bat
- %TEMP%\TwUQgEEM.bat
- <Current directory>\JowW.ico
- C:\RCX13.tmp
- <Current directory>\MsYU.exe
- <Current directory>\cYsK.exe
- C:\RCX17.tmp
- <Current directory>\YwYw.exe
- %TEMP%\ZegIokEI.bat
- <Current directory>\dwEs.exe
- <Current directory>\QcIK.ico
- <Current directory>\hMki.ico
- <Current directory>\vsgK.ico
- C:\RCX15.tmp
- <Current directory>\mkkW.exe
- %TEMP%\cWQEwIss.bat
- C:\RCX16.tmp
- %TEMP%\PysAYQYE.bat
- C:\RCXE.tmp
- %TEMP%\WogkIgAA.bat
- <Current directory>\NQIk.exe
- <Current directory>\xskO.ico
- <Current directory>\tMMa.exe
- C:\RCXD.tmp
- <Current directory>\mooi.exe
- %TEMP%\yWQosUck.bat
- %TEMP%\jCsYIMUc.bat
- <Current directory>\XkYe.ico
- C:\RCXF.tmp
- C:\RCX11.tmp
- <Current directory>\nAck.exe
- <Current directory>\awgI.ico
- C:\RCX12.tmp
- <Current directory>\JsMe.exe
- <Current directory>\xUwG.ico
- <Current directory>\rEEe.ico
- %TEMP%\OsEskQYY.bat
- <Current directory>\osgK.exe
- C:\RCX10.tmp
- %TEMP%\fqoscAkQ.bat
- %TEMP%\GAAYUkEk.bat
- C:\RCX1D.tmp
- <Current directory>\KMIQ.ico
- %TEMP%\PqIAEAgU.bat
- <Current directory>\PEUQ.exe
- <Current directory>\FkEQ.exe
- C:\RCX1C.tmp
- <Current directory>\TAQQ.exe
- %TEMP%\CSoYYoEY.bat
- <Current directory>\YYoG.ico
- %TEMP%\mGwwQQgA.bat
- C:\RCX1E.tmp
- %TEMP%\BAIMswAQ.bat
- %TEMP%\GgkEsAog.bat
- %TEMP%\gWYUUoEU.bat
- <Current directory>\PUUE.exe
- <Current directory>\doko.ico
- %TEMP%\LsggkMkk.bat
- <Current directory>\UQcE.exe
- <Current directory>\GgUg.ico
- C:\RCX1F.tmp
- %TEMP%\AgkIUcwM.bat
- %TEMP%\WeEgMAMg.bat
- %TEMP%\sscYwYwQ.bat
- %TEMP%\geMsMsoc.bat
- %TEMP%\hcoAoEYo.bat
- <Current directory>\bAIS.exe
- <Current directory>\SAgi.ico
- %TEMP%\dasgYYQw.bat
- <Current directory>\CUcu.ico
- C:\RCX18.tmp
- <Current directory>\RUwi.exe
- %TEMP%\PUoIkEMY.bat
- C:\RCX19.tmp
- %TEMP%\YAQMIcMM.bat
- C:\RCX1B.tmp
- %TEMP%\FgYQgMkY.bat
- %TEMP%\ngAMkUsw.bat
- <Current directory>\mcYs.ico
- %TEMP%\bSYwEwsI.bat
- <Current directory>\FYIq.exe
- %TEMP%\NSkAAAUg.bat
- C:\RCX1A.tmp
- %TEMP%\BwUYEMgE.bat
- <Current directory>\JgYC.ico
- %TEMP%\rUAUskoA.bat
- <Current directory>\xYEC.ico
- %TEMP%\tCkMgoAE.bat
- %TEMP%\SqQggIMw.bat
- %TEMP%\RkIgwkQI.bat
- %TEMP%\XSgwEwMc.bat
- %TEMP%\uAMQIAEk.bat
- %TEMP%\gKEAwQYs.bat
- %TEMP%\YYUUcEwE.bat
- %TEMP%\RyUocMwQ.bat
- %TEMP%\Kiwowssk.bat
- %TEMP%\CKcYwMAk.bat
- %TEMP%\KaEQQUIw.bat
- %TEMP%\VQEcEcgU.bat
- %TEMP%\eooswYsU.bat
- %TEMP%\QooQoMAM.bat
- %TEMP%\GcEYgkoA.bat
- <Current directory>\Cwws.exe
- <Current directory>\aEoa.ico
- %TEMP%\PgQQQcww.bat
- %TEMP%\seskYkoY.bat
- %TEMP%\JGMcUwQE.bat
- %TEMP%\xSYwIEAs.bat
- %TEMP%\bsEMIIwU.bat
- %TEMP%\PqMEkIcs.bat
- %TEMP%\IgoAUIow.bat
- %TEMP%\file.vbs
- %TEMP%\TUcMAIEI.bat
- %TEMP%\RkIYMQAQ.bat
- %TEMP%\tOckAUAU.bat
- %TEMP%\NyYUIsgc.bat
- %TEMP%\PeAIwEMc.bat
- <Current directory>\<Virus name>
- %TEMP%\nYkUYMow.bat
- %TEMP%\UQMkIoQs.bat
- %TEMP%\UMEkoEsU.bat
- %TEMP%\OocMogEU.bat
- %TEMP%\hCocgAsA.bat
- %TEMP%\PKQwYwgo.bat
- %TEMP%\McYYAUwM.bat
- %TEMP%\meAYUoYM.bat
- %TEMP%\niIsUgcE.bat
- %TEMP%\UsUcQYYc.bat
- %TEMP%\JgIcYUoY.bat
- %TEMP%\OOAkQIEs.bat
- %TEMP%\OSYwEYgQ.bat
- %TEMP%\wggkIYoQ.bat
- %TEMP%\zOoQcYQc.bat
- C:\RCX8.tmp
- <Current directory>\vwIs.ico
- C:\RCX9.tmp
- <Current directory>\tgQa.exe
- <Current directory>\mIsG.exe
- <Current directory>\esgi.exe
- <Current directory>\Bsoe.ico
- C:\RCX7.tmp
- <Current directory>\sIoS.ico
- %TEMP%\GGUAgsEA.bat
- %TEMP%\akMEscMY.bat
- %TEMP%\sIYcYckM.bat
- C:\RCXB.tmp
- <Current directory>\GsMQ.ico
- C:\RCXC.tmp
- <Current directory>\xcQa.exe
- %TEMP%\RokcgYAI.bat
- <Current directory>\lAEs.exe
- <Current directory>\VskU.ico
- C:\RCXA.tmp
- <Current directory>\fskA.exe
- <Current directory>\nYMq.ico
- <Current directory>\uYwC.exe
- %TEMP%\Xawssows.bat
- C:\RCX3.tmp
- %TEMP%\vMcMowww.bat
- <Current directory>\qksq.ico
- <Current directory>\DwMw.ico
- <Current directory>\OcMs.ico
- C:\RCX1.tmp
- <Current directory>\IkoU.exe
- %TEMP%\DMokgkoc.bat
- C:\RCX2.tmp
- <Current directory>\DcsY.exe
- <Current directory>\yQUU.ico
- C:\RCX5.tmp
- <Current directory>\XMwe.exe
- %TEMP%\CioocIYQ.bat
- C:\RCX6.tmp
- %TEMP%\eeoEAQEE.bat
- %TEMP%\lIksIYUM.bat
- C:\RCX4.tmp
- %TEMP%\QWYkcUEw.bat
- <Current directory>\AMso.exe
- <Current directory>\SQMm.ico
- %ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
- %HOMEPATH%\fCkYUMIQ\pUccUkoM.exe
- <Current directory>\Scco.ico
- <Current directory>\cYsK.exe
- <Current directory>\PUws.ico
- <Current directory>\MsYU.exe
- <Current directory>\JowW.ico
- <Current directory>\EYgO.exe
- %TEMP%\kEkMcAEo.bat
- <Current directory>\hMki.ico
- %TEMP%\ZegIokEI.bat
- <Current directory>\dwEs.exe
- <Current directory>\mkkW.exe
- <Current directory>\vsgK.ico
- <Current directory>\YwYw.exe
- %TEMP%\IkAsUcYw.bat
- %TEMP%\WogkIgAA.bat
- <Current directory>\NQIk.exe
- <Current directory>\xskO.ico
- %TEMP%\yWQosUck.bat
- <Current directory>\tMMa.exe
- <Current directory>\XkYe.ico
- <Current directory>\osgK.exe
- <Current directory>\xUwG.ico
- <Current directory>\JsMe.exe
- <Current directory>\awgI.ico
- <Current directory>\rEEe.ico
- %TEMP%\fqoscAkQ.bat
- <Current directory>\nAck.exe
- <Current directory>\YYoG.ico
- <Current directory>\PEUQ.exe
- <Current directory>\KMIQ.ico
- <Current directory>\mcYs.ico
- %TEMP%\mGwwQQgA.bat
- <Current directory>\FkEQ.exe
- %TEMP%\PqIAEAgU.bat
- <Current directory>\GgUg.ico
- %TEMP%\GgkEsAog.bat
- %TEMP%\gWYUUoEU.bat
- %TEMP%\GAAYUkEk.bat
- <Current directory>\UQcE.exe
- %TEMP%\WeEgMAMg.bat
- <Current directory>\TAQQ.exe
- <Current directory>\CUcu.ico
- %TEMP%\sscYwYwQ.bat
- %TEMP%\YAQMIcMM.bat
- <Current directory>\QcIK.ico
- %TEMP%\dasgYYQw.bat
- <Current directory>\RUwi.exe
- <Current directory>\bAIS.exe
- <Current directory>\FYIq.exe
- <Current directory>\JgYC.ico
- %TEMP%\ngAMkUsw.bat
- <Current directory>\SAgi.ico
- %TEMP%\BwUYEMgE.bat
- %TEMP%\FgYQgMkY.bat
- <Current directory>\xYEC.ico
- %TEMP%\seskYkoY.bat
- %TEMP%\RkIgwkQI.bat
- %TEMP%\PqMEkIcs.bat
- %TEMP%\tCkMgoAE.bat
- %TEMP%\XSgwEwMc.bat
- %TEMP%\JGMcUwQE.bat
- %TEMP%\QooQoMAM.bat
- <Current directory>\IkoU.exe
- <Current directory>\OcMs.ico
- %TEMP%\DMokgkoc.bat
- %TEMP%\GcEYgkoA.bat
- <Current directory>\Cwws.exe
- <Current directory>\aEoa.ico
- %TEMP%\SqQggIMw.bat
- %TEMP%\tOckAUAU.bat
- %TEMP%\UMEkoEsU.bat
- %TEMP%\UsUcQYYc.bat
- %TEMP%\PeAIwEMc.bat
- %TEMP%\nYkUYMow.bat
- %TEMP%\IgoAUIow.bat
- %TEMP%\wggkIYoQ.bat
- %TEMP%\McYYAUwM.bat
- %TEMP%\Kiwowssk.bat
- %TEMP%\KaEQQUIw.bat
- %TEMP%\niIsUgcE.bat
- %TEMP%\OocMogEU.bat
- %TEMP%\meAYUoYM.bat
- <Current directory>\vwIs.ico
- %TEMP%\akMEscMY.bat
- <Current directory>\lAEs.exe
- <Current directory>\mIsG.exe
- <Current directory>\sIoS.ico
- <Current directory>\tgQa.exe
- <Current directory>\VskU.ico
- %TEMP%\sIYcYckM.bat
- <Current directory>\GsMQ.ico
- <Current directory>\mooi.exe
- <Current directory>\fskA.exe
- <Current directory>\nYMq.ico
- <Current directory>\xcQa.exe
- %TEMP%\GGUAgsEA.bat
- <Current directory>\DcsY.exe
- <Current directory>\qksq.ico
- %TEMP%\Xawssows.bat
- <Current directory>\uYwC.exe
- <Current directory>\DwMw.ico
- %TEMP%\vMcMowww.bat
- <Current directory>\AMso.exe
- <Current directory>\yQUU.ico
- <Current directory>\esgi.exe
- <Current directory>\Bsoe.ico
- <Current directory>\SQMm.ico
- %TEMP%\eeoEAQEE.bat
- <Current directory>\XMwe.exe
- from C:\RCX15.tmp to <Current directory>\cYsK.exe
- from C:\RCX16.tmp to <Current directory>\mkkW.exe
- from C:\RCX17.tmp to <Current directory>\YwYw.exe
- from C:\RCX14.tmp to <Current directory>\EYgO.exe
- from C:\RCX11.tmp to <Current directory>\nAck.exe
- from C:\RCX12.tmp to <Current directory>\JsMe.exe
- from C:\RCX13.tmp to <Current directory>\MsYU.exe
- from C:\RCX18.tmp to <Current directory>\dwEs.exe
- from C:\RCX1D.tmp to <Current directory>\FkEQ.exe
- from C:\RCX1E.tmp to <Current directory>\PEUQ.exe
- from C:\RCX1F.tmp to <Current directory>\UQcE.exe
- from C:\RCX1C.tmp to <Current directory>\TAQQ.exe
- from C:\RCX19.tmp to <Current directory>\RUwi.exe
- from C:\RCX1A.tmp to <Current directory>\bAIS.exe
- from C:\RCX1B.tmp to <Current directory>\FYIq.exe
- from C:\RCX10.tmp to <Current directory>\osgK.exe
- from C:\RCX5.tmp to <Current directory>\AMso.exe
- from C:\RCX6.tmp to <Current directory>\XMwe.exe
- from C:\RCX7.tmp to <Current directory>\esgi.exe
- from C:\RCX4.tmp to <Current directory>\DcsY.exe
- from C:\RCX1.tmp to <Current directory>\Cwws.exe
- from C:\RCX2.tmp to <Current directory>\IkoU.exe
- from C:\RCX3.tmp to <Current directory>\uYwC.exe
- from C:\RCX8.tmp to <Current directory>\mIsG.exe
- from C:\RCXD.tmp to <Current directory>\mooi.exe
- from C:\RCXE.tmp to <Current directory>\tMMa.exe
- from C:\RCXF.tmp to <Current directory>\NQIk.exe
- from C:\RCXC.tmp to <Current directory>\xcQa.exe
- from C:\RCX9.tmp to <Current directory>\tgQa.exe
- from C:\RCXA.tmp to <Current directory>\lAEs.exe
- from C:\RCXB.tmp to <Current directory>\fskA.exe
- '19#.#86.45.170':9999
- '74.##5.232.51':80
- '20#.#7.164.69':9999
- '20#.#19.204.12':9999
- 74.##5.232.51/
- DNS ASK google.com
- ClassName: '' WindowName: 'pUccUkoM.exe'
- ClassName: '' WindowName: 'aeEkEEcE.exe'
- ClassName: 'Indicator' WindowName: ''