Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,C:\ProgramData\sIAowgok\rSYkcwMw.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rSYkcwMw.exe' = 'C:\ProgramData\sIAowgok\rSYkcwMw.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'GocwIYEU.exe' = '%HOMEPATH%\CaIocokM\GocwIYEU.exe'
- [<HKLM>\SYSTEM\ControlSet001\services\yoYkgMRX] 'Start' = '00000002'
- C:\ProgramData\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe
- C:\ProgramData\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe
- C:\ProgramData\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe
- C:\ProgramData\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe
- C:\ProgramData\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe
- hidden files
- file extensions
- User Account Control (UAC)
- 'C:\ProgramData\ZQIIosos\XiskIEYE.exe'
- 'C:\ProgramData\sIAowgok\rSYkcwMw.exe'
- '%HOMEPATH%\CaIocokM\GocwIYEU.exe'
- '<SYSTEM32>\reg.exe' 0x810 cscript.exe
- '<SYSTEM32>\conhost.exe' /c ""%TEMP%\SGoIcIww.bat" "<Full path to virus>""
- '<SYSTEM32>\taskhost.exe' /c ""%TEMP%\GMwAEsgM.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=0x810 /log
- '<SYSTEM32>\conhost.exe' /c ""%TEMP%\ZUIMwAwo.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=0xe84 /log
- '<SYSTEM32>\conhost.exe' /c "<Current directory>\<Virus name>"
- '<SYSTEM32>\reg.exe' /pid=0x984 /log
- '<SYSTEM32>\conhost.exe' /c ""%TEMP%\noYgcsgw.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=0x5e0 /log
- '<SYSTEM32>\reg.exe' 0xb20 <Virus name>.exe
- '<SYSTEM32>\conhost.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\taskhost.exe' <LS_APPDATA>\Temp/file.vbs
- '<SYSTEM32>\reg.exe' /pid=0xae8 /log
- '<SYSTEM32>\wbem\wmiprvse.exe'
- '<SYSTEM32>\conhost.exe'
- '<SYSTEM32>\conhost.exe' /c ""%TEMP%\qgQgQAEw.bat" "<Full path to virus>""
- '<SYSTEM32>\reg.exe' /pid=0xb80 /log
- '<SYSTEM32>\cscript.exe' <LS_APPDATA>\Temp/file.vbs
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' 0x960 cscript.exe
- '<SYSTEM32>\reg.exe' /pid=0x68c /log
- '<SYSTEM32>\conhost.exe' <LS_APPDATA>\Temp/file.vbs
- '<SYSTEM32>\taskhost.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' <LS_APPDATA>\Temp/file.vbs
- '<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\conhost.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' /pid=0x580 /log
- C:\RCXFBB2.tmp
- <Current directory>\ECIg.ico
- <Current directory>\MMkm.exe
- C:\RCXF99F.tmp
- <Current directory>\QWcI.ico
- <Current directory>\VMQW.exe
- C:\RCXFE62.tmp
- <Current directory>\GkIY.ico
- <Current directory>\SMQy.exe
- C:\RCX170.tmp
- <Current directory>\xWcs.ico
- <Current directory>\gUUw.exe
- C:\RCXFF8B.tmp
- <Current directory>\WsQs.exe
- C:\RCXF355.tmp
- <Current directory>\uQwM.ico
- <Current directory>\Lwwm.exe
- C:\RCXF0F4.tmp
- <Current directory>\GyEM.ico
- <Current directory>\OoQU.exe
- C:\RCXF605.tmp
- <Current directory>\dmkE.ico
- <Current directory>\Yscw.exe
- C:\RCXF411.tmp
- <Current directory>\jcEE.ico
- <Current directory>\uUIy.exe
- C:\RCX10FF.tmp
- <Current directory>\MsoA.ico
- <Current directory>\GYcU.exe
- C:\RCXD36.tmp
- <Current directory>\uQgQ.ico
- <Current directory>\XYIg.exe
- C:\RCX1286.tmp
- <Current directory>\IUso.ico
- <Current directory>\VkUi.exe
- C:\RCX1546.tmp
- <Current directory>\EEkM.ico
- <Current directory>\dEMQ.exe
- C:\RCX13AF.tmp
- %TEMP%\BeEQAUgs.bat
- <Current directory>\DQEc.ico
- <Current directory>\ucoE.exe
- <Current directory>\SSwY.ico
- <Current directory>\HQcG.exe
- C:\RCX3F0.tmp
- C:\RCX799.tmp
- C:\RCXB13.tmp
- <Current directory>\uOsc.ico
- <Current directory>\NUAS.exe
- %TEMP%\MisgwYEw.bat
- <Current directory>\naIg.ico
- <Current directory>\AsoQ.exe
- <Current directory>\QuQU.ico
- %TEMP%\EGIYcIos.bat
- <Current directory>\FQgE.exe
- C:\RCXD8F6.tmp
- <Current directory>\Jgss.exe
- C:\RCXD74F.tmp
- <Current directory>\hgkw.ico
- <Current directory>\pYgE.ico
- %TEMP%\SGoIcIww.bat
- <Current directory>\IEgY.exe
- C:\RCXDC81.tmp
- <Current directory>\vcgO.exe
- C:\RCXDADA.tmp
- <Current directory>\OEsg.ico
- <Current directory>\BqAE.ico
- <Current directory>\NAIS.exe
- C:\RCXD2DA.tmp
- <Current directory>\BsYg.ico
- <Current directory>\bMwo.exe
- C:\RCXD20E.tmp
- <Current directory>\QuEU.ico
- <Current directory>\Iswc.exe
- C:\RCXD452.tmp
- <Current directory>\TcYI.ico
- <Current directory>\zEAU.exe
- C:\RCXD3C5.tmp
- <Current directory>\ugEg.ico
- <Current directory>\qoUU.exe
- C:\RCXE7EC.tmp
- <Current directory>\eAIQ.ico
- <Current directory>\Mkoi.exe
- C:\RCXE710.tmp
- <Current directory>\sOYE.ico
- <Current directory>\EcEA.exe
- <Current directory>\iksk.exe
- C:\RCXEDE7.tmp
- %TEMP%\GMwAEsgM.bat
- C:\RCXE8D7.tmp
- <Current directory>\HEwI.ico
- %TEMP%\qqoAcwsE.bat
- <Current directory>\TMMw.ico
- <Current directory>\bsAa.exe
- C:\RCXDF02.tmp
- <Current directory>\OyYU.ico
- <Current directory>\CIMa.exe
- C:\RCXDE36.tmp
- <Current directory>\HSww.ico
- <Current directory>\UUMe.exe
- C:\RCXE55B.tmp
- <Current directory>\eaAY.ico
- <Current directory>\pQIC.exe
- C:\RCXE2F9.tmp
- <Current directory>\xKwk.ico
- C:\RCX3EBC.tmp
- <Current directory>\yeYU.ico
- <Current directory>\sgMa.exe
- C:\RCX3C3B.tmp
- <Current directory>\tsAU.ico
- <Current directory>\YYkI.exe
- C:\RCX40FE.tmp
- <Current directory>\WKog.ico
- <Current directory>\zUUA.exe
- C:\RCX44D7.tmp
- <Current directory>\UwkE.ico
- <Current directory>\WYsw.exe
- C:\RCX4266.tmp
- <Current directory>\xsMw.exe
- C:\RCX36DC.tmp
- <Current directory>\aWUo.ico
- <Current directory>\PcUQ.exe
- C:\RCX3564.tmp
- <Current directory>\TQYE.ico
- <Current directory>\pIoA.exe
- C:\RCX3A47.tmp
- <Current directory>\bYQM.ico
- <Current directory>\JAQo.exe
- C:\RCX37E6.tmp
- <Current directory>\GkIw.ico
- <Current directory>\vcIE.exe
- C:\RCX4EAC.tmp
- <Current directory>\eIow.ico
- <Current directory>\nsAi.exe
- C:\RCX4CF6.tmp
- <Current directory>\wmoo.ico
- <Current directory>\AcUI.exe
- C:\RCX4FF4.tmp
- <Current directory>\jIQI.ico
- <Current directory>\wMou.exe
- C:\RCX542B.tmp
- <Current directory>\GiEQ.ico
- <Current directory>\IAYO.exe
- C:\RCX5311.tmp
- <Current directory>\xcgw.ico
- %TEMP%\bugkkAMc.bat
- <Current directory>\mYMe.exe
- <Current directory>\jCgo.ico
- <Current directory>\ckAS.exe
- C:\RCX470A.tmp
- C:\RCX4843.tmp
- C:\RCX4B40.tmp
- <Current directory>\mkgU.ico
- <Current directory>\IooU.exe
- <Current directory>\mqsU.ico
- <Current directory>\XUEO.exe
- %TEMP%\EKkEYEgA.bat
- <Current directory>\Bwgs.ico
- %TEMP%\DssssoAc.bat
- <Current directory>\MQAc.ico
- <Current directory>\JcgO.exe
- <Current directory>\NGQg.ico
- <Current directory>\nQQi.exe
- C:\RCX1E21.tmp
- C:\RCX2063.tmp
- <Current directory>\Ioow.ico
- <Current directory>\wcIE.exe
- C:\RCX25B2.tmp
- <Current directory>\diMg.ico
- <Current directory>\mMIe.exe
- C:\RCX2303.tmp
- <Current directory>\xegU.ico
- <Current directory>\hQQo.exe
- C:\RCX17D7.tmp
- <Current directory>\uGcY.ico
- <Current directory>\gcMe.exe
- C:\RCX1621.tmp
- <Current directory>\xMoQ.ico
- <Current directory>\ygAK.exe
- C:\RCX1B42.tmp
- %TEMP%\MQUcogAE.bat
- <Current directory>\oksI.exe
- C:\RCX19FA.tmp
- <Current directory>\QKcA.ico
- <Current directory>\NkgU.exe
- C:\RCX2EEC.tmp
- <Current directory>\EQEo.ico
- <Current directory>\zckG.exe
- C:\RCX2D65.tmp
- <Current directory>\zSQg.ico
- <Current directory>\HwEM.exe
- <Current directory>\VAMg.exe
- C:\RCX3228.tmp
- %TEMP%\noYgcsgw.bat
- C:\RCX30A1.tmp
- %TEMP%\RIsQUgYM.bat
- <Current directory>\HOAE.ico
- <Current directory>\pIok.ico
- <Current directory>\sYoy.exe
- C:\RCX294C.tmp
- <Current directory>\mmYE.ico
- <Current directory>\gQQs.exe
- C:\RCX2749.tmp
- <Current directory>\xmsQ.ico
- <Current directory>\kwEs.exe
- C:\RCX2CA8.tmp
- <Current directory>\oUck.ico
- <Current directory>\XQgQ.exe
- C:\RCX2A85.tmp
- <Current directory>\YmsU.ico
- C:\RCXCFCC.tmp
- <Current directory>\kwoC.exe
- C:\RCX67AB.tmp
- <Current directory>\pOMc.ico
- <Current directory>\Bgsm.exe
- C:\RCX6634.tmp
- <Current directory>\kQQM.ico
- %TEMP%\RiwAcsII.bat
- <Current directory>\pcsc.exe
- C:\RCX6CBC.tmp
- %TEMP%\qgQgQAEw.bat
- <Current directory>\ZMco.exe
- C:\RCX6B16.tmp
- <Current directory>\omoE.ico
- <Current directory>\CsQA.ico
- <Current directory>\RgsS.exe
- C:\RCX622B.tmp
- <Current directory>\mMME.ico
- <Current directory>\cEEg.exe
- C:\RCX5DD6.tmp
- <Current directory>\egIw.ico
- <Current directory>\eEUo.exe
- C:\RCX6539.tmp
- <Current directory>\QKkk.ico
- <Current directory>\PUAc.exe
- C:\RCX63B2.tmp
- <Current directory>\pgQw.ico
- <Current directory>\Kcws.ico
- <Current directory>\uoYA.exe
- C:\RCX7BA0.tmp
- <Current directory>\pIsU.exe
- C:\RCX79DB.tmp
- <Auxiliary element>
- <Current directory>\MOQU.ico
- <Current directory>\nqUQ.ico
- <Current directory>\tEgo.exe
- C:\RCX81BA.tmp
- <Current directory>\lUUI.exe
- C:\RCX7E50.tmp
- %TEMP%\kqAsgckc.bat
- <Current directory>\JcAI.ico
- <Current directory>\gYYw.exe
- C:\RCX719E.tmp
- <Current directory>\EWcM.ico
- <Current directory>\lYAO.exe
- C:\RCX6F4C.tmp
- <Current directory>\VMwE.ico
- <Current directory>\tMAK.exe
- C:\RCX77C7.tmp
- <Current directory>\NYMA.ico
- <Current directory>\fMgi.exe
- C:\RCX741E.tmp
- <Current directory>\YMgY.ico
- C:\RCX5BC3.tmp
- C:\RCX45A9.tmp
- <Current directory>\rUUM.ico
- %TEMP%\file.vbs
- %TEMP%\fqQYUcsY.bat
- <Current directory>\oygA.ico
- <Current directory>\NAMy.exe
- <Current directory>\ywcY.exe
- C:\RCX49FE.tmp
- <Current directory>\FaMw.ico
- <Current directory>\JQIo.exe
- C:\RCX480A.tmp
- <Current directory>\ziso.ico
- <Current directory>\Sgoe.exe
- C:\ProgramData\kaog.txt
- <Current directory>\CAsI.ico
- <Current directory>\DsMo.exe
- %HOMEPATH%\CaIocokM\GocwIYEU
- C:\ProgramData\sIAowgok\rSYkcwMw
- C:\ProgramData\ZQIIosos\XiskIEYE.exe
- <SYSTEM32>\config\systemprofile\CaIocokM\GocwIYEU
- <Current directory>\<Virus name>
- <Current directory>\ekEc.exe
- C:\RCX4431.tmp
- C:\RCX4337.tmp
- <Current directory>\YSEc.ico
- %TEMP%\gasQIQgY.bat
- <Current directory>\zwEM.ico
- %TEMP%\NcMcEQwQ.bat
- <Current directory>\uUIg.exe
- <Current directory>\VkMg.ico
- <Current directory>\IMoM.exe
- C:\RCX5634.tmp
- C:\RCX575E.tmp
- C:\RCX59AF.tmp
- <Current directory>\XcAE.ico
- <Current directory>\kYki.exe
- %TEMP%\RGwcQoAU.bat
- <Current directory>\eWkQ.ico
- <Current directory>\OUko.exe
- C:\RCX4F7C.tmp
- <Current directory>\qoAg.ico
- <Current directory>\FcoM.exe
- C:\RCX4CEC.tmp
- <Current directory>\MSgw.ico
- <Current directory>\bYsS.exe
- C:\RCX5086.tmp
- <Current directory>\rwkQ.ico
- <Current directory>\HQMO.exe
- C:\RCX546F.tmp
- <Current directory>\pgQA.ico
- <Current directory>\vAsu.exe
- C:\RCX5374.tmp
- <Current directory>\mAwU.exe
- C:\RCXBB95.tmp
- <Current directory>\HUwQ.ico
- <Current directory>\HQYW.exe
- C:\RCXBA1E.tmp
- <Current directory>\PcMw.ico
- <Current directory>\TgMC.exe
- C:\RCXBE55.tmp
- <Current directory>\YyEM.ico
- <Current directory>\igsG.exe
- C:\RCXBD2C.tmp
- <Current directory>\TsEw.ico
- <Current directory>\IIMQ.exe
- <Current directory>\YIMa.exe
- C:\RCXB1D1.tmp
- %TEMP%\ZUIMwAwo.bat
- C:\RCXAF7F.tmp
- %TEMP%\beUEMcII.bat
- <Current directory>\NaYg.ico
- <Current directory>\yOYs.ico
- <Current directory>\wscg.exe
- C:\RCXB7BC.tmp
- <Current directory>\Bgcg.ico
- <Current directory>\uUYq.exe
- C:\RCXB52C.tmp
- <Current directory>\rygU.ico
- <Current directory>\sswm.exe
- C:\RCXC943.tmp
- <Current directory>\Lqgo.ico
- <Current directory>\WMIS.exe
- C:\RCXC81A.tmp
- <Current directory>\fEow.ico
- <Current directory>\toQQ.exe
- C:\RCXCDC8.tmp
- <Current directory>\wckc.ico
- <Current directory>\fUEC.exe
- C:\RCXCB95.tmp
- <Current directory>\dewA.ico
- <Current directory>\cgUa.exe
- C:\RCXC098.tmp
- <Current directory>\uOQo.ico
- <Current directory>\yEIS.exe
- C:\RCXBF21.tmp
- <Current directory>\mKMw.ico
- <Current directory>\hcsW.exe
- C:\RCXC376.tmp
- C:\RCXC56B.tmp
- <Current directory>\kIcs.ico
- %TEMP%\hcMYwcsE.bat
- %TEMP%\vmkwcowY.bat
- <Current directory>\DSQY.ico
- <Current directory>\cgAE.exe
- <Current directory>\lggY.exe
- <Current directory>\GoII.ico
- <Current directory>\RkkU.exe
- C:\RCX9070.tmp
- <Current directory>\gwgE.ico
- <Current directory>\MsAo.exe
- C:\RCX8DB1.tmp
- <Current directory>\uykM.ico
- <Current directory>\roMS.exe
- C:\RCX93CC.tmp
- <Current directory>\PAos.ico
- <Current directory>\DAwg.exe
- C:\RCX9264.tmp
- <Current directory>\JOQw.ico
- C:\RCX8525.tmp
- <Current directory>\XIkM.ico
- <Current directory>\UgAO.exe
- %TEMP%\eAgwEooc.bat
- <Current directory>\IuYU.ico
- <Current directory>\moYQ.exe
- C:\RCX8738.tmp
- <Current directory>\qwUI.ico
- <Current directory>\TkUc.exe
- C:\RCX8B4F.tmp
- <Current directory>\oWoE.ico
- <Current directory>\cQAa.exe
- C:\RCX8A45.tmp
- <Current directory>\NmYE.ico
- <Current directory>\tAkE.exe
- C:\RCXA80D.tmp
- <Current directory>\JEsU.ico
- <Current directory>\HUUO.exe
- C:\RCXA37A.tmp
- <Current directory>\UaEE.ico
- <Current directory>\YQwm.exe
- C:\RCXACD0.tmp
- <Current directory>\TMII.ico
- <Current directory>\TIgQ.exe
- C:\RCXAA11.tmp
- <Current directory>\RSAs.ico
- <Current directory>\BAMY.ico
- <Current directory>\mcMW.exe
- %TEMP%\wSEMgEUQ.bat
- %TEMP%\bYQokgcY.bat
- <Current directory>\lwkC.exe
- C:\RCX9784.tmp
- C:\RCX9A82.tmp
- <Current directory>\XSIs.ico
- <Current directory>\LkEM.exe
- C:\RCXA109.tmp
- <Current directory>\VuQo.ico
- <Current directory>\qwMo.exe
- C:\RCX9D7F.tmp
- <Current directory>\MMkm.exe
- <Current directory>\xWcs.ico
- <Current directory>\VMQW.exe
- <Current directory>\ECIg.ico
- <Current directory>\SMQy.exe
- <Current directory>\SSwY.ico
- <Current directory>\gUUw.exe
- <Current directory>\GkIY.ico
- <Current directory>\QWcI.ico
- <Current directory>\uQwM.ico
- <Current directory>\OoQU.exe
- <Current directory>\GyEM.ico
- <Current directory>\WsQs.exe
- <Current directory>\dmkE.ico
- <Current directory>\Yscw.exe
- <Current directory>\jcEE.ico
- <Current directory>\uUIy.exe
- <Current directory>\MsoA.ico
- <Current directory>\GYcU.exe
- <Current directory>\uQgQ.ico
- <Current directory>\XYIg.exe
- <Current directory>\IUso.ico
- <Current directory>\VkUi.exe
- <Current directory>\EEkM.ico
- <Current directory>\dEMQ.exe
- <Current directory>\NUAS.exe
- %TEMP%\BeEQAUgs.bat
- <Current directory>\DQEc.ico
- <Current directory>\HQcG.exe
- %TEMP%\GMwAEsgM.bat
- <Current directory>\AsoQ.exe
- <Current directory>\uOsc.ico
- <Current directory>\ucoE.exe
- <Current directory>\naIg.ico
- <Current directory>\vcgO.exe
- <Current directory>\OEsg.ico
- <Current directory>\FQgE.exe
- <Current directory>\pYgE.ico
- <Current directory>\CIMa.exe
- <Current directory>\TMMw.ico
- <Current directory>\IEgY.exe
- <Current directory>\OyYU.ico
- <Current directory>\hgkw.ico
- <Current directory>\zEAU.exe
- <Current directory>\ugEg.ico
- <Current directory>\NAIS.exe
- <Current directory>\QuEU.ico
- <Current directory>\Jgss.exe
- %TEMP%\EGIYcIos.bat
- <Current directory>\Iswc.exe
- <Current directory>\TcYI.ico
- %TEMP%\qqoAcwsE.bat
- <Current directory>\HEwI.ico
- <Current directory>\eAIQ.ico
- <Current directory>\EcEA.exe
- <Current directory>\QuQU.ico
- <Current directory>\Lwwm.exe
- <Current directory>\iksk.exe
- %TEMP%\SGoIcIww.bat
- <Current directory>\qoUU.exe
- <Current directory>\pQIC.exe
- <Current directory>\xKwk.ico
- <Current directory>\bsAa.exe
- <Current directory>\HSww.ico
- <Current directory>\Mkoi.exe
- <Current directory>\sOYE.ico
- <Current directory>\UUMe.exe
- <Current directory>\eaAY.ico
- <Current directory>\uGcY.ico
- <Current directory>\YYkI.exe
- <Current directory>\yeYU.ico
- <Current directory>\JAQo.exe
- <Current directory>\tsAU.ico
- <Current directory>\WYsw.exe
- <Current directory>\WKog.ico
- <Current directory>\sgMa.exe
- <Current directory>\UwkE.ico
- <Current directory>\bYQM.ico
- <Current directory>\TQYE.ico
- <Current directory>\xsMw.exe
- <Current directory>\Bwgs.ico
- <Current directory>\PcUQ.exe
- <Current directory>\GkIw.ico
- <Current directory>\vcIE.exe
- <Current directory>\aWUo.ico
- <Current directory>\pIoA.exe
- <Current directory>\wmoo.ico
- <Current directory>\AcUI.exe
- <Current directory>\mkgU.ico
- <Current directory>\IooU.exe
- <Current directory>\GiEQ.ico
- <Current directory>\IAYO.exe
- <Current directory>\eIow.ico
- <Current directory>\nsAi.exe
- <Current directory>\XUEO.exe
- <Current directory>\ckAS.exe
- %TEMP%\noYgcsgw.bat
- <Current directory>\zUUA.exe
- <Current directory>\jCgo.ico
- <Current directory>\mYMe.exe
- <Current directory>\mqsU.ico
- %TEMP%\bugkkAMc.bat
- <Current directory>\xcgw.ico
- <Current directory>\JcgO.exe
- %TEMP%\MisgwYEw.bat
- <Current directory>\nQQi.exe
- <Current directory>\MQAc.ico
- <Current directory>\Ioow.ico
- <Current directory>\wcIE.exe
- <Current directory>\diMg.ico
- <Current directory>\mMIe.exe
- <Current directory>\NGQg.ico
- <Current directory>\hQQo.exe
- <Current directory>\xMoQ.ico
- <Current directory>\gcMe.exe
- <Current directory>\xegU.ico
- <Current directory>\ygAK.exe
- %TEMP%\MQUcogAE.bat
- <Current directory>\oksI.exe
- <Current directory>\QKcA.ico
- <Current directory>\NkgU.exe
- <Current directory>\EQEo.ico
- <Current directory>\zckG.exe
- <Current directory>\zSQg.ico
- <Current directory>\HOAE.ico
- <Current directory>\VAMg.exe
- <Current directory>\HwEM.exe
- %TEMP%\RIsQUgYM.bat
- <Current directory>\oUck.ico
- <Current directory>\pIok.ico
- <Current directory>\sYoy.exe
- <Current directory>\mmYE.ico
- <Current directory>\gQQs.exe
- <Current directory>\YmsU.ico
- <Current directory>\kwEs.exe
- <Current directory>\xmsQ.ico
- <Current directory>\XQgQ.exe
- <Current directory>\BqAE.ico
- <Current directory>\omoE.ico
- <Current directory>\pcsc.exe
- <Current directory>\ZMco.exe
- %TEMP%\RiwAcsII.bat
- <Current directory>\JcAI.ico
- <Current directory>\gYYw.exe
- <Current directory>\EWcM.ico
- <Current directory>\lYAO.exe
- <Current directory>\pOMc.ico
- <Current directory>\pgQw.ico
- <Current directory>\eEUo.exe
- <Current directory>\egIw.ico
- <Current directory>\PUAc.exe
- <Current directory>\kQQM.ico
- <Current directory>\kwoC.exe
- <Current directory>\QKkk.ico
- <Current directory>\Bgsm.exe
- <Current directory>\nqUQ.ico
- <Current directory>\tEgo.exe
- <Current directory>\lUUI.exe
- %TEMP%\kqAsgckc.bat
- <Current directory>\moYQ.exe
- <Current directory>\XIkM.ico
- %TEMP%\qgQgQAEw.bat
- <Current directory>\IuYU.ico
- <Current directory>\MOQU.ico
- <Current directory>\YMgY.ico
- <Current directory>\tMAK.exe
- <Current directory>\VMwE.ico
- <Current directory>\fMgi.exe
- <Current directory>\Kcws.ico
- <Current directory>\uoYA.exe
- <Current directory>\NYMA.ico
- <Current directory>\pIsU.exe
- <Current directory>\FaMw.ico
- <Current directory>\JQIo.exe
- <Current directory>\ziso.ico
- <Current directory>\Sgoe.exe
- <Current directory>\qoAg.ico
- <Current directory>\FcoM.exe
- <Current directory>\MSgw.ico
- <Current directory>\bYsS.exe
- <Current directory>\ywcY.exe
- %TEMP%\gasQIQgY.bat
- <Current directory>\YSEc.ico
- <Current directory>\CAsI.ico
- <Current directory>\DsMo.exe
- <Current directory>\NAMy.exe
- <Current directory>\rUUM.ico
- <Current directory>\ekEc.exe
- <Current directory>\oygA.ico
- <Current directory>\XcAE.ico
- <Current directory>\kYki.exe
- <Current directory>\eWkQ.ico
- <Current directory>\OUko.exe
- <Current directory>\CsQA.ico
- <Current directory>\RgsS.exe
- <Current directory>\mMME.ico
- <Current directory>\cEEg.exe
- <Current directory>\uUIg.exe
- <Current directory>\rwkQ.ico
- <Current directory>\HQMO.exe
- <Current directory>\pgQA.ico
- <Current directory>\vAsu.exe
- %TEMP%\NcMcEQwQ.bat
- <Current directory>\zwEM.ico
- <Current directory>\VkMg.ico
- <Current directory>\IMoM.exe
- <Current directory>\UgAO.exe
- <Current directory>\IIMQ.exe
- <Current directory>\YyEM.ico
- <Current directory>\TgMC.exe
- <Current directory>\TsEw.ico
- <Current directory>\hcsW.exe
- <Current directory>\uOQo.ico
- <Current directory>\igsG.exe
- <Current directory>\mKMw.ico
- <Current directory>\HUwQ.ico
- <Current directory>\rygU.ico
- <Current directory>\wscg.exe
- <Current directory>\yOYs.ico
- <Current directory>\uUYq.exe
- <Current directory>\PcMw.ico
- <Current directory>\mAwU.exe
- <Current directory>\Bgcg.ico
- <Current directory>\HQYW.exe
- <Current directory>\dewA.ico
- <Current directory>\cgUa.exe
- <Current directory>\Lqgo.ico
- <Current directory>\toQQ.exe
- <Current directory>\BsYg.ico
- <Current directory>\bMwo.exe
- <Current directory>\wckc.ico
- <Current directory>\fUEC.exe
- <Current directory>\sswm.exe
- <Current directory>\DSQY.ico
- <Current directory>\cgAE.exe
- <Current directory>\yEIS.exe
- %TEMP%\vmkwcowY.bat
- <Current directory>\WMIS.exe
- <Current directory>\fEow.ico
- %TEMP%\ZUIMwAwo.bat
- <Current directory>\kIcs.ico
- <Current directory>\roMS.exe
- <Current directory>\PAos.ico
- <Current directory>\DAwg.exe
- <Current directory>\JOQw.ico
- <Current directory>\BAMY.ico
- <Current directory>\mcMW.exe
- <Current directory>\lwkC.exe
- %TEMP%\bYQokgcY.bat
- <Current directory>\uykM.ico
- <Current directory>\qwUI.ico
- <Current directory>\TkUc.exe
- <Current directory>\oWoE.ico
- <Current directory>\cQAa.exe
- <Current directory>\GoII.ico
- <Current directory>\RkkU.exe
- <Current directory>\gwgE.ico
- <Current directory>\MsAo.exe
- <Current directory>\YQwm.exe
- <Current directory>\TMII.ico
- <Current directory>\TIgQ.exe
- <Current directory>\RSAs.ico
- <Current directory>\NaYg.ico
- <Current directory>\YIMa.exe
- <Current directory>\lggY.exe
- %TEMP%\beUEMcII.bat
- <Current directory>\UaEE.ico
- <Current directory>\XSIs.ico
- <Current directory>\LkEM.exe
- <Current directory>\VuQo.ico
- <Current directory>\qwMo.exe
- <Current directory>\NmYE.ico
- <Current directory>\tAkE.exe
- <Current directory>\JEsU.ico
- <Current directory>\HUUO.exe
- from C:\RCXFE62.tmp to <Current directory>\MMkm.exe
- from C:\RCXFBB2.tmp to <Current directory>\VMQW.exe
- from C:\RCX170.tmp to <Current directory>\SMQy.exe
- from C:\RCXFF8B.tmp to <Current directory>\gUUw.exe
- from C:\RCXF411.tmp to <Current directory>\OoQU.exe
- from C:\RCXF355.tmp to <Current directory>\WsQs.exe
- from C:\RCXF99F.tmp to <Current directory>\Yscw.exe
- from C:\RCXF605.tmp to <Current directory>\uUIy.exe
- from C:\RCX1286.tmp to <Current directory>\GYcU.exe
- from C:\RCX10FF.tmp to <Current directory>\XYIg.exe
- from C:\RCX1546.tmp to <Current directory>\VkUi.exe
- from C:\RCX13AF.tmp to <Current directory>\dEMQ.exe
- from C:\RCX799.tmp to <Current directory>\ucoE.exe
- from C:\RCX3F0.tmp to <Current directory>\HQcG.exe
- from C:\RCXD36.tmp to <Current directory>\NUAS.exe
- from C:\RCXB13.tmp to <Current directory>\AsoQ.exe
- from C:\RCXDADA.tmp to <Current directory>\vcgO.exe
- from C:\RCXD8F6.tmp to <Current directory>\FQgE.exe
- from C:\RCXDE36.tmp to <Current directory>\CIMa.exe
- from C:\RCXDC81.tmp to <Current directory>\IEgY.exe
- from C:\RCXD3C5.tmp to <Current directory>\zEAU.exe
- from C:\RCXD2DA.tmp to <Current directory>\NAIS.exe
- from C:\RCXD74F.tmp to <Current directory>\Jgss.exe
- from C:\RCXD452.tmp to <Current directory>\Iswc.exe
- from C:\RCXE8D7.tmp to <Current directory>\EcEA.exe
- from C:\RCXE7EC.tmp to <Current directory>\qoUU.exe
- from C:\RCXF0F4.tmp to <Current directory>\Lwwm.exe
- from C:\RCXEDE7.tmp to <Current directory>\iksk.exe
- from C:\RCXE2F9.tmp to <Current directory>\pQIC.exe
- from C:\RCXDF02.tmp to <Current directory>\bsAa.exe
- from C:\RCXE710.tmp to <Current directory>\Mkoi.exe
- from C:\RCXE55B.tmp to <Current directory>\UUMe.exe
- from C:\RCX3EBC.tmp to <Current directory>\YYkI.exe
- from C:\RCX3C3B.tmp to <Current directory>\JAQo.exe
- from C:\RCX4266.tmp to <Current directory>\WYsw.exe
- from C:\RCX40FE.tmp to <Current directory>\sgMa.exe
- from C:\RCX36DC.tmp to <Current directory>\xsMw.exe
- from C:\RCX3564.tmp to <Current directory>\PcUQ.exe
- from C:\RCX3A47.tmp to <Current directory>\vcIE.exe
- from C:\RCX37E6.tmp to <Current directory>\pIoA.exe
- from C:\RCX4EAC.tmp to <Current directory>\AcUI.exe
- from C:\RCX4CF6.tmp to <Current directory>\IooU.exe
- from C:\RCX5311.tmp to <Current directory>\IAYO.exe
- from C:\RCX4FF4.tmp to <Current directory>\nsAi.exe
- from C:\RCX470A.tmp to <Current directory>\ckAS.exe
- from C:\RCX44D7.tmp to <Current directory>\zUUA.exe
- from C:\RCX4B40.tmp to <Current directory>\XUEO.exe
- from C:\RCX4843.tmp to <Current directory>\mYMe.exe
- from C:\RCX2063.tmp to <Current directory>\JcgO.exe
- from C:\RCX1E21.tmp to <Current directory>\nQQi.exe
- from C:\RCX25B2.tmp to <Current directory>\wcIE.exe
- from C:\RCX2303.tmp to <Current directory>\mMIe.exe
- from C:\RCX17D7.tmp to <Current directory>\hQQo.exe
- from C:\RCX1621.tmp to <Current directory>\gcMe.exe
- from C:\RCX1B42.tmp to <Current directory>\ygAK.exe
- from C:\RCX19FA.tmp to <Current directory>\oksI.exe
- from C:\RCX2EEC.tmp to <Current directory>\NkgU.exe
- from C:\RCX2D65.tmp to <Current directory>\zckG.exe
- from C:\RCX3228.tmp to <Current directory>\VAMg.exe
- from C:\RCX30A1.tmp to <Current directory>\HwEM.exe
- from C:\RCX294C.tmp to <Current directory>\sYoy.exe
- from C:\RCX2749.tmp to <Current directory>\gQQs.exe
- from C:\RCX2CA8.tmp to <Current directory>\kwEs.exe
- from C:\RCX2A85.tmp to <Current directory>\XQgQ.exe
- from C:\RCX6CBC.tmp to <Current directory>\pcsc.exe
- from C:\RCX6B16.tmp to <Current directory>\ZMco.exe
- from C:\RCX719E.tmp to <Current directory>\gYYw.exe
- from C:\RCX6F4C.tmp to <Current directory>\lYAO.exe
- from C:\RCX6539.tmp to <Current directory>\eEUo.exe
- from C:\RCX63B2.tmp to <Current directory>\PUAc.exe
- from C:\RCX67AB.tmp to <Current directory>\kwoC.exe
- from C:\RCX6634.tmp to <Current directory>\Bgsm.exe
- from C:\RCX81BA.tmp to <Current directory>\tEgo.exe
- from C:\RCX7E50.tmp to <Current directory>\lUUI.exe
- from C:\RCX8738.tmp to <Current directory>\UgAO.exe
- from C:\RCX8525.tmp to <Current directory>\moYQ.exe
- from C:\RCX77C7.tmp to <Current directory>\tMAK.exe
- from C:\RCX741E.tmp to <Current directory>\fMgi.exe
- from C:\RCX7BA0.tmp to <Current directory>\uoYA.exe
- from C:\RCX79DB.tmp to <Current directory>\pIsU.exe
- from C:\RCX4CEC.tmp to <Current directory>\JQIo.exe
- from C:\RCX49FE.tmp to <Current directory>\Sgoe.exe
- from C:\RCX5086.tmp to <Current directory>\FcoM.exe
- from C:\RCX4F7C.tmp to <Current directory>\bYsS.exe
- from C:\RCX4431.tmp to <Current directory>\ekEc.exe
- from C:\RCX4337.tmp to <Current directory>\DsMo.exe
- from C:\RCX480A.tmp to <Current directory>\ywcY.exe
- from C:\RCX45A9.tmp to <Current directory>\NAMy.exe
- from C:\RCX5BC3.tmp to <Current directory>\kYki.exe
- from C:\RCX59AF.tmp to <Current directory>\OUko.exe
- from C:\RCX622B.tmp to <Current directory>\RgsS.exe
- from C:\RCX5DD6.tmp to <Current directory>\cEEg.exe
- from C:\RCX546F.tmp to <Current directory>\HQMO.exe
- from C:\RCX5374.tmp to <Current directory>\vAsu.exe
- from C:\RCX575E.tmp to <Current directory>\uUIg.exe
- from C:\RCX5634.tmp to <Current directory>\IMoM.exe
- from C:\RCXBE55.tmp to <Current directory>\IIMQ.exe
- from C:\RCXBD2C.tmp to <Current directory>\TgMC.exe
- from C:\RCXC098.tmp to <Current directory>\hcsW.exe
- from C:\RCXBF21.tmp to <Current directory>\igsG.exe
- from C:\RCXB7BC.tmp to <Current directory>\wscg.exe
- from C:\RCXB52C.tmp to <Current directory>\uUYq.exe
- from C:\RCXBB95.tmp to <Current directory>\mAwU.exe
- from C:\RCXBA1E.tmp to <Current directory>\HQYW.exe
- from C:\RCXCDC8.tmp to <Current directory>\cgUa.exe
- from C:\RCXCB95.tmp to <Current directory>\toQQ.exe
- from C:\RCXD20E.tmp to <Current directory>\bMwo.exe
- from C:\RCXCFCC.tmp to <Current directory>\fUEC.exe
- from C:\RCXC56B.tmp to <Current directory>\cgAE.exe
- from C:\RCXC376.tmp to <Current directory>\yEIS.exe
- from C:\RCXC943.tmp to <Current directory>\sswm.exe
- from C:\RCXC81A.tmp to <Current directory>\WMIS.exe
- from C:\RCX93CC.tmp to <Current directory>\roMS.exe
- from C:\RCX9264.tmp to <Current directory>\DAwg.exe
- from C:\RCX9A82.tmp to <Current directory>\mcMW.exe
- from C:\RCX9784.tmp to <Current directory>\lwkC.exe
- from C:\RCX8B4F.tmp to <Current directory>\TkUc.exe
- from C:\RCX8A45.tmp to <Current directory>\cQAa.exe
- from C:\RCX9070.tmp to <Current directory>\RkkU.exe
- from C:\RCX8DB1.tmp to <Current directory>\MsAo.exe
- from C:\RCXACD0.tmp to <Current directory>\YQwm.exe
- from C:\RCXAA11.tmp to <Current directory>\TIgQ.exe
- from C:\RCXB1D1.tmp to <Current directory>\YIMa.exe
- from C:\RCXAF7F.tmp to <Current directory>\lggY.exe
- from C:\RCXA109.tmp to <Current directory>\LkEM.exe
- from C:\RCX9D7F.tmp to <Current directory>\qwMo.exe
- from C:\RCXA80D.tmp to <Current directory>\tAkE.exe
- from C:\RCXA37A.tmp to <Current directory>\HUUO.exe
- DNS ASK dn#.##ftncsi.com
- DNS ASK google.com
- ClassName: '' WindowName: 'GocwIYEU.exe'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'rSYkcwMw.exe'