Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdwadm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemanmaz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqfslg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemegmeo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgwxcr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxkvpp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmveip.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtoilm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemagtdx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqfbbj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmnjey.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnpbcx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmsqem.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjdudv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvfzsu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnaktb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtafmc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrajew.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeispj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmeykg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembagay.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembvfvf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtqowz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxbwat.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyswel.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuwcsb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtowco.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemybdva.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqememjid.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgwioi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemosemy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuwnhc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemppdxf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlymiu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjinbv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzhotn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemciawe.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyozdv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemobzer.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjcdfi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcldlm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnfrbf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkbjjr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjbirw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtkhfa.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemexexv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfejle.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemaeyqv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnybtx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrnpfx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempfges.exe'
Modifies file system
Creates the following files
- %TEMP%\qpath.ini
- %TEMP%\sysqemxbwat.exe
- %TEMP%\sysqemanmaz.exe
- %TEMP%\sysqemqfslg.exe
- %TEMP%\sysqemegmeo.exe
- %TEMP%\sysqemgwxcr.exe
- %TEMP%\sysqemxkvpp.exe
- %TEMP%\sysqemmveip.exe
- %TEMP%\sysqemtoilm.exe
- %TEMP%\sysqemagtdx.exe
- %TEMP%\sysqemqfbbj.exe
- %TEMP%\sysqemmnjey.exe
- %TEMP%\sysqemyswel.exe
- %TEMP%\sysqemnpbcx.exe
- %TEMP%\sysqemjdudv.exe
- %TEMP%\sysqemvfzsu.exe
- %TEMP%\sysqemnaktb.exe
- %TEMP%\sysqemtafmc.exe
- %TEMP%\sysqemrajew.exe
- %TEMP%\sysqemeispj.exe
- %TEMP%\sysqemmeykg.exe
- %TEMP%\sysqembagay.exe
- %TEMP%\sysqembvfvf.exe
- %TEMP%\sysqemtqowz.exe
- %TEMP%\sysqemuwcsb.exe
- %TEMP%\sysqemmsqem.exe
- %TEMP%\sysqemrnpfx.exe
- %TEMP%\sysqemnybtx.exe
- %TEMP%\sysqamqqvaqqd.exe
- %TEMP%\sysqemdwadm.exe
- %TEMP%\sysqemybdva.exe
- %TEMP%\sysqememjid.exe
- %TEMP%\sysqemgwioi.exe
- %TEMP%\sysqemosemy.exe
- %TEMP%\sysqemuwnhc.exe
- %TEMP%\sysqemppdxf.exe
- %TEMP%\sysqemlymiu.exe
- %TEMP%\sysqemjinbv.exe
- %TEMP%\sysqemzhotn.exe
- %TEMP%\sysqemciawe.exe
- %TEMP%\sysqemtowco.exe
- %TEMP%\sysqemyozdv.exe
- %TEMP%\sysqemjcdfi.exe
- %TEMP%\sysqemcldlm.exe
- %TEMP%\sysqemnfrbf.exe
- %TEMP%\sysqemkbjjr.exe
- %TEMP%\sysqemjbirw.exe
- %TEMP%\sysqemtkhfa.exe
- %TEMP%\sysqemexexv.exe
- %TEMP%\sysqemfejle.exe
- %TEMP%\sysqemaeyqv.exe
- %TEMP%\sysqemobzer.exe
- %TEMP%\sysqempfges.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\sysqemdwadm.exe
- %TEMP%\sysqemqfslg.exe
- %TEMP%\sysqemegmeo.exe
- %TEMP%\sysqemgwxcr.exe
- %TEMP%\sysqemxkvpp.exe
- %TEMP%\sysqemmveip.exe
- %TEMP%\sysqemtoilm.exe
- %TEMP%\sysqemagtdx.exe
- %TEMP%\sysqemqfbbj.exe
- %TEMP%\sysqemmnjey.exe
- %TEMP%\sysqemxbwat.exe
- %TEMP%\sysqemanmaz.exe
- %TEMP%\sysqemyswel.exe
- %TEMP%\sysqemvfzsu.exe
- %TEMP%\sysqemnaktb.exe
- %TEMP%\sysqemtafmc.exe
- %TEMP%\sysqemrajew.exe
- %TEMP%\sysqemeispj.exe
- %TEMP%\sysqemmeykg.exe
- %TEMP%\sysqembagay.exe
- %TEMP%\sysqembvfvf.exe
- %TEMP%\sysqemtqowz.exe
- %TEMP%\sysqemnpbcx.exe
- %TEMP%\sysqemjdudv.exe
- %TEMP%\sysqemuwcsb.exe
- %TEMP%\sysqemrnpfx.exe
- %TEMP%\sysqemobzer.exe
- %TEMP%\sysqemybdva.exe
- %TEMP%\sysqememjid.exe
- %TEMP%\sysqemgwioi.exe
- %TEMP%\sysqemosemy.exe
- %TEMP%\sysqemuwnhc.exe
- %TEMP%\sysqemppdxf.exe
- %TEMP%\sysqemlymiu.exe
- %TEMP%\sysqemjinbv.exe
- %TEMP%\sysqemzhotn.exe
- %TEMP%\sysqemciawe.exe
- %TEMP%\sysqamqqvaqqd.exe
- %TEMP%\sysqemtowco.exe
- %TEMP%\sysqemjcdfi.exe
- %TEMP%\sysqemcldlm.exe
- %TEMP%\sysqemnfrbf.exe
- %TEMP%\sysqemkbjjr.exe
- %TEMP%\sysqemjbirw.exe
- %TEMP%\sysqemtkhfa.exe
- %TEMP%\sysqemexexv.exe
- %TEMP%\sysqemfejle.exe
- %TEMP%\sysqemaeyqv.exe
- %TEMP%\sysqemnybtx.exe
- %TEMP%\sysqemyozdv.exe
- %TEMP%\sysqemmsqem.exe
- %TEMP%\sysqempfges.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\sysqemdwadm.exe'
- '%TEMP%\sysqemanmaz.exe'
- '%TEMP%\sysqemqfslg.exe'
- '%TEMP%\sysqemegmeo.exe'
- '%TEMP%\sysqemgwxcr.exe'
- '%TEMP%\sysqemxkvpp.exe'
- '%TEMP%\sysqemmveip.exe'
- '%TEMP%\sysqemtoilm.exe'
- '%TEMP%\sysqemagtdx.exe'
- '%TEMP%\sysqemqfbbj.exe'
- '%TEMP%\sysqemmnjey.exe'
- '%TEMP%\sysqemnpbcx.exe'
- '%TEMP%\sysqemmsqem.exe'
- '%TEMP%\sysqemjdudv.exe'
- '%TEMP%\sysqemvfzsu.exe'
- '%TEMP%\sysqemnaktb.exe'
- '%TEMP%\sysqemtafmc.exe'
- '%TEMP%\sysqemrajew.exe'
- '%TEMP%\sysqemeispj.exe'
- '%TEMP%\sysqemmeykg.exe'
- '%TEMP%\sysqembagay.exe'
- '%TEMP%\sysqembvfvf.exe'
- '%TEMP%\sysqemtqowz.exe'
- '%TEMP%\sysqemxbwat.exe'
- '%TEMP%\sysqemyswel.exe'
- '%TEMP%\sysqemuwcsb.exe'
- '%TEMP%\sysqemtowco.exe'
- '%TEMP%\sysqemybdva.exe'
- '%TEMP%\sysqememjid.exe'
- '%TEMP%\sysqemgwioi.exe'
- '%TEMP%\sysqemosemy.exe'
- '%TEMP%\sysqemuwnhc.exe'
- '%TEMP%\sysqemppdxf.exe'
- '%TEMP%\sysqemlymiu.exe'
- '%TEMP%\sysqemjinbv.exe'
- '%TEMP%\sysqemzhotn.exe'
- '%TEMP%\sysqemciawe.exe'
- '%TEMP%\sysqemyozdv.exe'
- '%TEMP%\sysqemobzer.exe'
- '%TEMP%\sysqemjcdfi.exe'
- '%TEMP%\sysqemcldlm.exe'
- '%TEMP%\sysqemnfrbf.exe'
- '%TEMP%\sysqemkbjjr.exe'
- '%TEMP%\sysqemjbirw.exe'
- '%TEMP%\sysqemtkhfa.exe'
- '%TEMP%\sysqemexexv.exe'
- '%TEMP%\sysqemfejle.exe'
- '%TEMP%\sysqemaeyqv.exe'
- '%TEMP%\sysqemnybtx.exe'
- '%TEMP%\sysqemrnpfx.exe'
- '%TEMP%\sysqempfges.exe'
