Trojan.DownLoader9.18751

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Yqily' = '%APPDATA%\Roaming\Soodb\yqily.exe'

Malicious functions:

Creates and executes the following:

'%APPDATA%\Roaming\Soodb\yqily.exe'

Executes the following:

'<SYSTEM32>\wermgr.exe' -queuereporting
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\taskhost.exe"

Injects code into

the following system processes:

<SYSTEM32>\rundll32.exe

Modifies file system :

Creates the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xcprozwkfalvcknxcisnrocal_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\onwkgalreqglrlptvglijojr_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\yhtsinhejfkzauqhlzteivgnz_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mzrsbytolcalcyjeutwdaldq_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mjhltjhupbovtyhpncyeyemrxc_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hnjizfyzpcultgihljytqshm_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xvchpvhlfpbibiftgtgttsmrba_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nzhcqbuqkaugmynzusmbjrifskai_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\depwgyxbrzpcqaulxkiwg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\davwyxjfukemhobwschaiwoeq_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hvcrcivvkgypzivwirxwrsvoamqo_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qworirydhieifqcqinjvpcuzl_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pfalnbyxtseyauqoeacelfdjnjr_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hjzxyldfipzpskmjvkbicedpn_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ibpftwdmgmcasgkvivpvufmvhinz_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xohytxnzlrdylnzgylfaitknz_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qgmbhembkbhsklxkdxpnqswo_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vkhyhbawrdmijobmbqfaxh_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ibgezxkzcihtkvmnnzrwauduhipzh_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qcgigmgastcmzrwukyfislnkzrg_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\sgaqemdueulfaibxkbunrrfqnbsctg_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fizlxwjnhazdxojbvsrsvkkjaenvd_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\buwoeuifrszaumxzpcaypgylhmhy_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ainzxhqtgxozdluwpqwpuxgjb_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\phpprpqoppveicucyhqfeor_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mbthilneanflbamnteyeyqcgunbam_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uxhenjltvsbaucijmfaejf_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wivsxgwscljztjypcmhqtrg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hztaytqougojvbiloblbvw_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\sgiffecmqoemyfyaiovtzxvo_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wskfqsuolpknyltkxamxcivmjnf_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\deiqcylxlxwcskgetlvkncyaq_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rghyvkxzpkvxcrcgmrdpdc_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vsorzmzvcmgecigunzsodaljro_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pfukxljqcqkdetsgymjhahizkzqo_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\swzdwdiskeaxkvgzhhqgilvamhukv_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\auzdvkgpobmvcuwcskbevrcknozvg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\projkrfuxoljnhgsqweicpkr_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\sgferobmcnrpfpfxwdduga_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xhmjaikjgesogudjvcidmvay_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xdacyqgqicmpzhjvxjbpscv_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gelnjdifxjzpfonwsbcmtin_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ayrolnibxolnqklzplozcmukzpw_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\iflzyhhdaqgmjvcwckfzhqkxozgqby_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dibqcahorhicixkxxpihqhx_ru[1]
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\65DD2C3F-00000001.eml:OECustomProperty
%TEMP%\tmp4da9da92.bat
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\65DD2C3F-00000001.eml
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol
%TEMP%\Cab222.tmp
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nznvcebecqeidgiporfqxnfoztw_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wkknxcldiiaynvfqvkobfquozx_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\eqhihyxtfkvonyxsoxowkus_info[1]
%TEMP%\Tar223.tmp
%TEMP%\ppcrlui_4052_2
<LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\edb00002.log
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore
%APPDATA%\Roaming\Soodb\yqily.exe
<LS_APPDATA>\Microsoft\Windows Mail\tmp.edb
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\edb.log
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ivwgxofargpvgjfcmojlsc_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\twylpprknjlrinugauyxqodlrkyh_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xgbexctrcpeykfwkgyxvgmbhis_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jvojnflduldrlgypbvcjfmzuc_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwtobtwhjbpbawgmrojnnjyxjzmv_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kfrwntgmbxucgidqrdvkaecumzce_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gibygmxddqucuceibmgaunjkz_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hqtizojbeyusirdqpqwkfauufu_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xrcbahueymrxfuzkjlfeqsg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\tzxpqopbglnhtkrggypcude_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwcqdavoxlfinzlrceihaonrozpgivs_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\debqxcmjtpbutsojhukcyzhlfceu_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jzifhqskvdypzdtdmtwlkbgy_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\suwcycqswjzyklnqwdmdxoijlr_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lftsetlkceuogeljkbl_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ibtwpfhskaetqopzxnrnfdqu_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kheciinkpflkvfedaixcmdaior_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\eutcqnvkrtwtskfduhnbxk_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dqvgwoxqsxbuytuonszhdz_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vammrhojbtaewceanrxclrayx_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lvlpflaufqxoufagykbhylbkj_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dyfqkbugxgfixhabmgihrkfydceqo_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dmdelfedqtgemtglkvdimzvcnjge_org[1]

Deletes the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\depwgyxbrzpcqaulxkiwg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xvchpvhlfpbibiftgtgttsmrba_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\davwyxjfukemhobwschaiwoeq_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hvcrcivvkgypzivwirxwrsvoamqo_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nzhcqbuqkaugmynzusmbjrifskai_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\sgferobmcnrpfpfxwdduga_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\auzdvkgpobmvcuwcskbevrcknozvg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\buwoeuifrszaumxzpcaypgylhmhy_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\projkrfuxoljnhgsqweicpkr_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ibgezxkzcihtkvmnnzrwauduhipzh_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mzrsbytolcalcyjeutwdaldq_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qcgigmgastcmzrwukyfislnkzrg_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vkhyhbawrdmijobmbqfaxh_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mjhltjhupbovtyhpncyeyemrxc_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\onwkgalreqglrlptvglijojr_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hnjizfyzpcultgihljytqshm_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\yhtsinhejfkzauqhlzteivgnz_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xcprozwkfalvcknxcisnrocal_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pfukxljqcqkdetsgymjhahizkzqo_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\phpprpqoppveicucyhqfeor_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hztaytqougojvbiloblbvw_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mbthilneanflbamnteyeyqcgunbam_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ainzxhqtgxozdluwpqwpuxgjb_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rghyvkxzpkvxcrcgmrdpdc_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\sgiffecmqoemyfyaiovtzxvo_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wskfqsuolpknyltkxamxcivmjnf_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vsorzmzvcmgecigunzsodaljro_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\deiqcylxlxwcskgetlvkncyaq_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\iflzyhhdaqgmjvcwckfzhqkxozgqby_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dibqcahorhicixkxxpihqhx_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\swzdwdiskeaxkvgzhhqgilvamhukv_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xhmjaikjgesogudjvcidmvay_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ayrolnibxolnqklzplozcmukzpw_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uxhenjltvsbaucijmfaejf_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wivsxgwscljztjypcmhqtrg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xdacyqgqicmpzhjvxjbpscv_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gelnjdifxjzpfonwsbcmtin_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\suwcycqswjzyklnqwdmdxoijlr_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\eutcqnvkrtwtskfduhnbxk_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lftsetlkceuogeljkbl_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jzifhqskvdypzdtdmtwlkbgy_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dyfqkbugxgfixhabmgihrkfydceqo_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dqvgwoxqsxbuytuonszhdz_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vammrhojbtaewceanrxclrayx_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dmdelfedqtgemtglkvdimzvcnjge_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lvlpflaufqxoufagykbhylbkj_info[1]
%TEMP%\ppcrlui_4052_2
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\eqhihyxtfkvonyxsoxowkus_info[1]
%TEMP%\Cab222.tmp
%TEMP%\Tar223.tmp
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nznvcebecqeidgiporfqxnfoztw_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ibtwpfhskaetqopzxnrnfdqu_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kheciinkpflkvfedaixcmdaior_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wkknxcldiiaynvfqvkobfquozx_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ivwgxofargpvgjfcmojlsc_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwtobtwhjbpbawgmrojnnjyxjzmv_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xohytxnzlrdylnzgylfaitknz_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hjzxyldfipzpskmjvkbicedpn_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xrcbahueymrxfuzkjlfeqsg_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ibpftwdmgmcasgkvivpvufmvhinz_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qworirydhieifqcqinjvpcuzl_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\sgaqemdueulfaibxkbunrrfqnbsctg_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fizlxwjnhazdxojbvsrsvkkjaenvd_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pfalnbyxtseyauqoeacelfdjnjr_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qgmbhembkbhsklxkdxpnqswo_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\twylpprknjlrinugauyxqodlrkyh_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xgbexctrcpeykfwkgyxvgmbhis_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kfrwntgmbxucgidqrdvkaecumzce_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jvojnflduldrlgypbvcjfmzuc_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gibygmxddqucuceibmgaunjkz_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\tzxpqopbglnhtkrggypcude_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hqtizojbeyusirdqpqwkfauufu_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwcqdavoxlfinzlrceihaonrozpgivs_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\debqxcmjtpbutsojhukcyzhlfceu_net[1]

Moves the following files:

from <LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log to <LS_APPDATA>\Microsoft\Windows Mail\edb.log

Deletes itself.

Network activity:

Connects to:

'xv#######pbibiftgtgttsmrba.net':80
'nz########ugmynzusmbjrifskai.org':80
'hv#######gypzivwirxwrsvoamqo.ru':80
'de######rzpcqaulxkiwg.com':80
'bu########zaumxzpcaypgylhmhy.info':80
'au########mvcuwcskbevrcknozvg.com':80
'pf########kdetsgymjhahizkzqo.info':80
'pr#######oljnhgsqweicpkr.biz':80
'sg######cnrpfpfxwdduga.ru':80
'mz#######calcyjeutwdaldq.com':80
'mj#######bovtyhpncyeyemrxc.ru':80
'vk######rdmijobmbqfaxh.org':80
'ib########htkvmnnzrwauduhipzh.info':80
'yh#######fkzauqhlzteivgnz.biz':80
'hn#######cultgihljytqshm.net':80
'da#######kemhobwschaiwoeq.com':80
'xc#######alvcknxcisnrocal.info':80
'on#######qglrlptvglijojr.org':80
'ph######ppveicucyhqfeor.biz':80
'hz######ugojvbiloblbvw.org':80
'mb########flbamnteyeyqcgunbam.ru':80
'ai#######xozdluwpqwpuxgjb.com':80
'rg######pkvxcrcgmrdpdc.net':80
'sg#######oemyfyaiovtzxvo.biz':80
'ws#######pknyltkxamxcivmjnf.net':80
'vs#######mgecigunzsodaljro.com':80
'de#######xwcskgetlvkncyaq.ru':80
'if########gmjvcwckfzhqkxozgqby.com':80
'di######rhicixkxxpihqhx.ru':80
'sw########axkvgzhhqgilvamhukv.org':80
'xh#######esogudjvcidmvay.biz':80
'ay#######olnqklzplozcmukzpw.com':80
'ux######vsbaucijmfaejf.info':80
'wi######cljztjypcmhqtrg.com':80
'xd######icmpzhjvxjbpscv.net':80
'ge######xjzpfonwsbcmtin.biz':80
'qc#######tcmzrwukyfislnkzrg.biz':80
'eu######rtwtskfduhnbxk.biz':80
'dy########fixhabmgihrkfydceqo.net':80
'jz#######dypzdtdmtwlkbgy.com':80
'su#######jzyklnqwdmdxoijlr.ru':80
'dm########gemtglkvdimzvcnjge.org':80
'va#######taewceanrxclrayx.ru':80
'uw########pbawgmrojnnjyxjzmv.com':80
'lv#######qxoufagykbhylbkj.info':80
'dq######sxbuytuonszhdz.com':80
'eq#######kvonyxsoxowkus.info':80
'nz#######qeidgiporfqxnfoztw.com':80
'74.##5.232.51':80
'www.bing.com':80
'wk#######iaynvfqvkobfquozx.ru':80
'kh#######flkvfedaixcmdaior.org':80
'lf#####kceuogeljkbl.net':80
'iv######rgpvgjfcmojlsc.com':80
'ib#######aetqopzxnrnfdqu.biz':80
'xo#######rdylnzgylfaitknz.com':80
'hj#######pzpskmjvkbicedpn.info':80
'xr######ymrxfuzkjlfeqsg.com':80
'ib#######mcasgkvivpvufmvhinz.ru':80
'qw#######ieifqcqinjvpcuzl.biz':80
'sg########lfaibxkbunrrfqnbsctg.ru':80
'fi########zdxojbvsrsvkkjaenvd.com':80
'pf#######seyauqoeacelfdjnjr.net':80
'qg#######bhsklxkdxpnqswo.com':80
'tw########lrinugauyxqodlrkyh.net':80
'xg#######peykfwkgyxvgmbhis.biz':80
'kf########ucgidqrdvkaecumzce.info':80
'jv#######ldrlgypbvcjfmzuc.org':80
'gi#######qucuceibmgaunjkz.ru':80
'tz######glnhtkrggypcude.org':80
'hq#######yusirdqpqwkfauufu.biz':80
'uw########finzlrceihaonrozpgivs.com':80
'de########butsojhukcyzhlfceu.net':80

TCP:

HTTP GET requests:

xv#######pbibiftgtgttsmrba.net/
nz########ugmynzusmbjrifskai.org/
hv#######gypzivwirxwrsvoamqo.ru/
de######rzpcqaulxkiwg.com/
bu########zaumxzpcaypgylhmhy.info/
au########mvcuwcskbevrcknozvg.com/
pf########kdetsgymjhahizkzqo.info/
pr#######oljnhgsqweicpkr.biz/
sg######cnrpfpfxwdduga.ru/
mz#######calcyjeutwdaldq.com/
mj#######bovtyhpncyeyemrxc.ru/
vk######rdmijobmbqfaxh.org/
ib########htkvmnnzrwauduhipzh.info/
yh#######fkzauqhlzteivgnz.biz/
hn#######cultgihljytqshm.net/
da#######kemhobwschaiwoeq.com/
xc#######alvcknxcisnrocal.info/
on#######qglrlptvglijojr.org/
ph######ppveicucyhqfeor.biz/
hz######ugojvbiloblbvw.org/
mb########flbamnteyeyqcgunbam.ru/
ai#######xozdluwpqwpuxgjb.com/
rg######pkvxcrcgmrdpdc.net/
sg#######oemyfyaiovtzxvo.biz/
ws#######pknyltkxamxcivmjnf.net/
vs#######mgecigunzsodaljro.com/
de#######xwcskgetlvkncyaq.ru/
if########gmjvcwckfzhqkxozgqby.com/
di######rhicixkxxpihqhx.ru/
sw########axkvgzhhqgilvamhukv.org/
xh#######esogudjvcidmvay.biz/
ay#######olnqklzplozcmukzpw.com/
ux######vsbaucijmfaejf.info/
wi######cljztjypcmhqtrg.com/
xd######icmpzhjvxjbpscv.net/
ge######xjzpfonwsbcmtin.biz/
qc#######tcmzrwukyfislnkzrg.biz/
eu######rtwtskfduhnbxk.biz/
dy########fixhabmgihrkfydceqo.net/
jz#######dypzdtdmtwlkbgy.com/
su#######jzyklnqwdmdxoijlr.ru/
dm########gemtglkvdimzvcnjge.org/
va#######taewceanrxclrayx.ru/
uw########pbawgmrojnnjyxjzmv.com/
lv#######qxoufagykbhylbkj.info/
dq######sxbuytuonszhdz.com/
eq#######kvonyxsoxowkus.info/
nz#######qeidgiporfqxnfoztw.com/
74.##5.232.51/
www.bing.com/
wk#######iaynvfqvkobfquozx.ru/
kh#######flkvfedaixcmdaior.org/
lf#####kceuogeljkbl.net/
iv######rgpvgjfcmojlsc.com/
ib#######aetqopzxnrnfdqu.biz/
xo#######rdylnzgylfaitknz.com/
hj#######pzpskmjvkbicedpn.info/
xr######ymrxfuzkjlfeqsg.com/
ib#######mcasgkvivpvufmvhinz.ru/
qw#######ieifqcqinjvpcuzl.biz/
sg########lfaibxkbunrrfqnbsctg.ru/
fi########zdxojbvsrsvkkjaenvd.com/
pf#######seyauqoeacelfdjnjr.net/
qg#######bhsklxkdxpnqswo.com/
tw########lrinugauyxqodlrkyh.net/
xg#######peykfwkgyxvgmbhis.biz/
kf########ucgidqrdvkaecumzce.info/
jv#######ldrlgypbvcjfmzuc.org/
gi#######qucuceibmgaunjkz.ru/
tz######glnhtkrggypcude.org/
hq#######yusirdqpqwkfauufu.biz/
uw########finzlrceihaonrozpgivs.com/
de########butsojhukcyzhlfceu.net/

UDP:

DNS ASK xc#######alvcknxcisnrocal.info
DNS ASK on#######qglrlptvglijojr.org
DNS ASK yh#######fkzauqhlzteivgnz.biz
DNS ASK mz#######calcyjeutwdaldq.com
DNS ASK mj#######bovtyhpncyeyemrxc.ru
DNS ASK hn#######cultgihljytqshm.net
DNS ASK xv#######pbibiftgtgttsmrba.net
DNS ASK nz########ugmynzusmbjrifskai.org
DNS ASK de######rzpcqaulxkiwg.com
DNS ASK da#######kemhobwschaiwoeq.com
DNS ASK hv#######gypzivwirxwrsvoamqo.ru
DNS ASK qw#######ieifqcqinjvpcuzl.biz
DNS ASK pf#######seyauqoeacelfdjnjr.net
DNS ASK hj#######pzpskmjvkbicedpn.info
DNS ASK ws#######pknyltkxamxcivmjnf.net
DNS ASK xo#######rdylnzgylfaitknz.com
DNS ASK qg#######bhsklxkdxpnqswo.com
DNS ASK vk######rdmijobmbqfaxh.org
DNS ASK ib########htkvmnnzrwauduhipzh.info
DNS ASK qc#######tcmzrwukyfislnkzrg.biz
DNS ASK sg########lfaibxkbunrrfqnbsctg.ru
DNS ASK fi########zdxojbvsrsvkkjaenvd.com
DNS ASK mb########flbamnteyeyqcgunbam.ru
DNS ASK ai#######xozdluwpqwpuxgjb.com
DNS ASK wi######cljztjypcmhqtrg.com
DNS ASK ge######xjzpfonwsbcmtin.biz
DNS ASK ux######vsbaucijmfaejf.info
DNS ASK ph######ppveicucyhqfeor.biz
DNS ASK de#######xwcskgetlvkncyaq.ru
DNS ASK sg#######oemyfyaiovtzxvo.biz
DNS ASK vs#######mgecigunzsodaljro.com
DNS ASK hz######ugojvbiloblbvw.org
DNS ASK rg######pkvxcrcgmrdpdc.net
DNS ASK au########mvcuwcskbevrcknozvg.com
DNS ASK pf########kdetsgymjhahizkzqo.info
DNS ASK sg######cnrpfpfxwdduga.ru
DNS ASK bu########zaumxzpcaypgylhmhy.info
DNS ASK pr#######oljnhgsqweicpkr.biz
DNS ASK sw########axkvgzhhqgilvamhukv.org
DNS ASK ay#######olnqklzplozcmukzpw.com
DNS ASK xd######icmpzhjvxjbpscv.net
DNS ASK di######rhicixkxxpihqhx.ru
DNS ASK xh#######esogudjvcidmvay.biz
DNS ASK if########gmjvcwckfzhqkxozgqby.com
DNS ASK lf#####kceuogeljkbl.net
DNS ASK kh#######flkvfedaixcmdaior.org
DNS ASK ib#######aetqopzxnrnfdqu.biz
DNS ASK jz#######dypzdtdmtwlkbgy.com
DNS ASK dy########fixhabmgihrkfydceqo.net
DNS ASK eu######rtwtskfduhnbxk.biz
DNS ASK su#######jzyklnqwdmdxoijlr.ru
DNS ASK www.bing.com
DNS ASK www.google.com
DNS ASK ib#######mcasgkvivpvufmvhinz.ru
DNS ASK eq#######kvonyxsoxowkus.info
DNS ASK iv######rgpvgjfcmojlsc.com
DNS ASK wk#######iaynvfqvkobfquozx.ru
DNS ASK nz#######qeidgiporfqxnfoztw.com
DNS ASK dm########gemtglkvdimzvcnjge.org
DNS ASK uw########finzlrceihaonrozpgivs.com
DNS ASK gi#######qucuceibmgaunjkz.ru
DNS ASK xg#######peykfwkgyxvgmbhis.biz
DNS ASK de########butsojhukcyzhlfceu.net
DNS ASK xr######ymrxfuzkjlfeqsg.com
DNS ASK hq#######yusirdqpqwkfauufu.biz
DNS ASK tz######glnhtkrggypcude.org
DNS ASK va#######taewceanrxclrayx.ru
DNS ASK dq######sxbuytuonszhdz.com
DNS ASK lv#######qxoufagykbhylbkj.info
DNS ASK uw########pbawgmrojnnjyxjzmv.com
DNS ASK tw########lrinugauyxqodlrkyh.net
DNS ASK jv#######ldrlgypbvcjfmzuc.org
DNS ASK kf########ucgidqrdvkaecumzce.info
'14#.#36.161.103':14675
'18#.#41.97.79':10039
'19#.#4.127.98':25549
'68.##6.150.60':19559
'14.#9.84.94':25047
'12#.#3.176.175':16542
'22#.#65.51.240':15690
'49.##.247.54':26513
'85.##.68.163':16892
'69.##.132.197':13027
'10#.#15.44.142':20626
'19#.#1.84.108':16276
'21#.#09.241.213':16882
'18#.#7.50.91':27916
'41.##1.123.49':16095
'95.##8.32.241':11952

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'OutlookExpressHiddenWindow' WindowName: ''
ClassName: 'Indicator' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial