Trojan.Siggen31.35902

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Chrome' = '"%LOCALAPPDATA%\24A6C86B-03AF-D04E-0DBE-2D770B52C1B0\Chrome.exe" '
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKCU\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\mimicfile\shell\open\command] '' = 'notepad.exe "%LOCALAPPDATA%\Important_Notice.txt"'

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'

Searches for windows to

detect analytical utilities:

ClassName: 'RegmonClass', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\istanbul.exe
%TEMP%\7zipsfx.000\xdel.exe
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\7za.exe
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\everything.exe
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\everything.ini
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\everything2.ini
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\everything32.dll
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\everything64.dll
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\xdel.exe
%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\session.tmp
C:\temp\session.tmp
C:\important_notice.txt
%TEMP%\7zsfx000.cmd
%LOCALAPPDATA%\important_notice.txt

Deletes the following files

%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zipsfx.000\istanbul.exe
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zsfx000.cmd

Moves the following files

from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\steam\steam.exe to %ProgramFiles(x86)%\steam\steam.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prcr.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prcr.x3d.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\proof\msth7es.lex to %ProgramFiles%\microsoft office\office14\proof\msth7es.lex.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex to %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\proof\msth7en.lex to %ProgramFiles%\microsoft office\office14\proof\msth7en.lex.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\infopath.exe to %ProgramFiles%\microsoft office\office14\infopath.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\mset7ge.kic to %ProgramFiles%\microsoft office\office14\mset7ge.kic.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\groove.exe to %ProgramFiles%\microsoft office\office14\groove.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\installed_resources14.xss to %ProgramFiles%\microsoft office\office14\installed_resources14.xss.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\pptico.exe to %ProgramFiles%\microsoft office\office14\pptico.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\outlook.exe to %ProgramFiles%\microsoft office\office14\outlook.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\excel.exe to %ProgramFiles%\microsoft office\office14\excel.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\excelcnv.exe to %ProgramFiles%\microsoft office\office14\excelcnv.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\graph.exe to %ProgramFiles%\microsoft office\office14\graph.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\msaccess.exe to %ProgramFiles%\microsoft office\office14\msaccess.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\mspub.exe to %ProgramFiles%\microsoft office\office14\mspub.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu to %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu to %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\winword.hxs to %ProgramFiles%\microsoft office\office14\1033\winword.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs to %ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\excel.hxs to %ProgramFiles%\microsoft office\office14\1033\excel.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx to %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx to %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\fiverules.potx to %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx to %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\outlook.hxs to %ProgramFiles%\microsoft office\office14\1033\outlook.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\groove.hxs to %ProgramFiles%\microsoft office\office14\1033\groove.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\msaccess.hxs to %ProgramFiles%\microsoft office\office14\1033\msaccess.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\microsoft office\office14\outlfltr.dat to %ProgramFiles%\microsoft office\office14\outlfltr.dat.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\dvd maker\dvdmaker.exe to %ProgramFiles%\dvd maker\dvdmaker.exe.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground_pal.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground_pal.wmv.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground.wmv.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground_pal.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground_pal.wmv.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground.wmv.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsmainbackground_pal.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsmainbackground_pal.wmv.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe

Modifies the following files

%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\startupcache.8.little.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\mozilla thunderbird\omni.ja.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\office14\mset7ge.kic.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\office14\installed_resources14.xss.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\fiverules.potx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe
%ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.istanbul-jp3eeil02mb3ijv_dhukj9prz3fuptfa8p4l3hs7wxe

Deletes itself.

Network activity

Connects to

'<LOCALNET>..19.0':445
'<LOCALNET>..19.1':445
'<LOCALNET>..19.2':445
'<LOCALNET>..19.3':445
'<LOCALNET>..19.4':445
'<LOCALNET>..19.5':445
'<LOCALNET>..19.6':445
'<LOCALNET>..19.7':445
'<LOCALNET>..19.8':445
'<LOCALNET>..19.9':445
'<LOCALNET>..19.10':445
'<LOCALNET>..19.11':445
'<LOCALNET>..19.12':445
'<LOCALNET>..19.13':445
'<LOCALNET>..19.14':445
'<LOCALNET>..19.15':445
'<LOCALNET>..19.16':445
'<LOCALNET>..19.17':445
'<LOCALNET>..19.18':445
'<LOCALNET>..19.19':445
'<LOCALNET>..19.20':445
'<LOCALNET>..19.21':445
'<LOCALNET>..19.22':445
'<LOCALNET>..19.23':445
'<LOCALNET>..19.24':445
'<LOCALNET>..19.25':445
'<LOCALNET>..19.26':445
'<LOCALNET>..19.27':445
'<LOCALNET>..19.28':445
'<LOCALNET>..19.29':445
'<LOCALNET>..19.30':445
'<LOCALNET>..19.31':445
'<LOCALNET>..19.32':445
'<LOCALNET>..19.33':445
'<LOCALNET>..19.34':445
'<LOCALNET>..19.35':445
'<LOCALNET>..19.36':445
'<LOCALNET>..19.37':445
'<LOCALNET>..19.38':445
'<LOCALNET>..19.39':445
'<LOCALNET>..19.40':445
'<LOCALNET>..19.41':445
'<LOCALNET>..19.42':445
'<LOCALNET>..19.43':445
'<LOCALNET>..19.44':445
'<LOCALNET>..19.45':445
'<LOCALNET>..19.46':445
'<LOCALNET>..19.47':445
'<LOCALNET>..19.48':445
'<LOCALNET>..19.49':445
'<LOCALNET>..19.50':445
'<LOCALNET>..19.51':445
'<LOCALNET>..19.52':445
'<LOCALNET>..19.53':445
'<LOCALNET>..19.54':445
'<LOCALNET>..19.55':445
'<LOCALNET>..19.56':445
'<LOCALNET>..19.57':445
'<LOCALNET>..19.58':445
'<LOCALNET>..19.59':445
'<LOCALNET>..19.60':445
'<LOCALNET>..19.61':445
'<LOCALNET>..19.62':445
'<LOCALNET>..19.63':445
'<LOCALNET>..19.64':445
'<LOCALNET>..19.65':445
'<LOCALNET>..19.66':445
'<LOCALNET>..19.67':445
'<LOCALNET>..19.68':445
'<LOCALNET>..19.69':445
'<LOCALNET>..19.70':445
'<LOCALNET>..19.71':445
'<LOCALNET>..19.72':445
'<LOCALNET>..19.73':445
'<LOCALNET>..19.74':445
'<LOCALNET>..19.75':445
'<LOCALNET>..19.76':445
'<LOCALNET>..19.77':445
'<LOCALNET>..19.78':445
'<LOCALNET>..19.79':445
'<LOCALNET>..19.80':445
'<LOCALNET>..19.81':445
'<LOCALNET>..19.82':445
'<LOCALNET>..19.83':445
'<LOCALNET>..19.84':445
'<LOCALNET>..19.85':445
'<LOCALNET>..19.86':445
'<LOCALNET>..19.87':445
'<LOCALNET>..19.88':445
'<LOCALNET>..19.89':445
'<LOCALNET>..19.90':445
'<LOCALNET>..19.91':445
'<LOCALNET>..19.92':445
'<LOCALNET>..19.93':445
'<LOCALNET>..19.94':445
'<LOCALNET>..19.95':445
'<LOCALNET>..19.96':445
'<LOCALNET>..19.97':445
'<LOCALNET>..19.98':445
'<LOCALNET>..19.99':445
'<LOCALNET>..19.100':445
'<LOCALNET>..19.101':445
'<LOCALNET>..19.102':445
'<LOCALNET>..19.103':445
'<LOCALNET>..19.104':445
'<LOCALNET>..19.105':445
'<LOCALNET>..19.106':445
'<LOCALNET>..19.107':445
'<LOCALNET>..19.108':445
'<LOCALNET>..19.109':445
'<LOCALNET>..19.110':445
'<LOCALNET>..19.111':445
'<LOCALNET>..19.112':445
'<LOCALNET>..19.113':445
'<LOCALNET>..19.114':445
'<LOCALNET>..19.115':445
'<LOCALNET>..19.116':445
'<LOCALNET>..19.117':445
'<LOCALNET>..19.118':445
'<LOCALNET>..19.119':445
'<LOCALNET>..19.120':445
'<LOCALNET>..19.121':445
'<LOCALNET>..19.122':445
'<LOCALNET>..19.123':445
'<LOCALNET>..19.124':445
'<LOCALNET>..19.125':445
'<LOCALNET>..19.126':445
'<LOCALNET>..19.127':445
'<LOCALNET>..19.128':445
'<LOCALNET>..19.129':445
'<LOCALNET>..19.130':445
'<LOCALNET>..19.131':445
'<LOCALNET>..19.132':445
'<LOCALNET>..19.133':445
'<LOCALNET>..19.134':445
'<LOCALNET>..19.135':445
'<LOCALNET>..19.136':445
'<LOCALNET>..19.137':445
'<LOCALNET>..19.138':445
'<LOCALNET>..19.139':445
'<LOCALNET>..19.140':445
'<LOCALNET>..19.141':445
'<LOCALNET>..19.142':445
'<LOCALNET>..19.143':445
'<LOCALNET>..19.144':445
'<LOCALNET>..19.145':445
'<LOCALNET>..19.146':445
'<LOCALNET>..19.147':445
'<LOCALNET>..19.148':445
'<LOCALNET>..19.149':445
'<LOCALNET>..19.150':445
'<LOCALNET>..19.151':445
'<LOCALNET>..19.152':445
'<LOCALNET>..19.153':445
'<LOCALNET>..19.154':445
'<LOCALNET>..19.155':445
'<LOCALNET>..19.156':445
'<LOCALNET>..19.157':445
'<LOCALNET>..19.158':445
'<LOCALNET>..19.159':445
'<LOCALNET>..19.160':445
'<LOCALNET>..19.161':445
'<LOCALNET>..19.162':445
'<LOCALNET>..19.163':445
'<LOCALNET>..19.164':445
'<LOCALNET>..19.165':445
'<LOCALNET>..19.166':445
'<LOCALNET>..19.167':445
'<LOCALNET>..19.168':445
'<LOCALNET>..19.169':445
'<LOCALNET>..19.170':445
'<LOCALNET>..19.171':445
'<LOCALNET>..19.172':445
'<LOCALNET>..19.173':445
'<LOCALNET>..19.174':445
'<LOCALNET>..19.175':445
'<LOCALNET>..19.176':445
'<LOCALNET>..19.177':445
'<LOCALNET>..19.178':445
'<LOCALNET>..19.179':445
'<LOCALNET>..19.180':445
'<LOCALNET>..19.181':445
'<LOCALNET>..19.182':445
'<LOCALNET>..19.183':445
'<LOCALNET>..19.184':445
'<LOCALNET>..19.185':445
'<LOCALNET>..19.186':445
'<LOCALNET>..19.187':445
'<LOCALNET>..19.188':445
'<LOCALNET>..19.189':445
'<LOCALNET>..19.190':445
'<LOCALNET>..19.191':445
'<LOCALNET>..19.192':445
'<LOCALNET>..19.193':445
'<LOCALNET>..19.194':445
'<LOCALNET>..19.195':445
'<LOCALNET>..19.196':445
'<LOCALNET>..19.197':445
'<LOCALNET>..19.198':445
'<LOCALNET>..19.199':445
'<LOCALNET>..19.200':445
'<LOCALNET>..19.201':445
'<LOCALNET>..19.202':445
'<LOCALNET>..19.203':445
'<LOCALNET>..19.204':445
'<LOCALNET>..19.205':445
'<LOCALNET>..19.206':445
'<LOCALNET>..19.207':445
'<LOCALNET>..19.208':445
'<LOCALNET>..19.209':445
'<LOCALNET>..19.210':445
'<LOCALNET>..19.211':445
'<LOCALNET>..19.212':445
'<LOCALNET>..19.213':445
'<LOCALNET>..19.214':445
'<LOCALNET>..19.215':445
'<LOCALNET>..19.216':445
'<LOCALNET>..19.217':445
'<LOCALNET>..19.218':445
'<LOCALNET>..19.219':445
'<LOCALNET>..19.220':445
'<LOCALNET>..19.221':445
'<LOCALNET>..19.222':445
'<LOCALNET>..19.223':445
'<LOCALNET>..19.224':445
'<LOCALNET>..19.225':445
'<LOCALNET>..19.226':445
'<LOCALNET>..19.227':445
'<LOCALNET>..19.228':445
'<LOCALNET>..19.229':445
'<LOCALNET>..19.230':445
'<LOCALNET>..19.231':445
'<LOCALNET>..19.232':445
'<LOCALNET>..19.233':445
'<LOCALNET>..19.234':445
'<LOCALNET>..19.235':445
'<LOCALNET>..19.236':445
'<LOCALNET>..19.237':445
'<LOCALNET>..19.238':445
'<LOCALNET>..19.239':445
'<LOCALNET>..19.240':445
'<LOCALNET>..19.241':445
'<LOCALNET>..19.242':445
'<LOCALNET>..19.243':445
'<LOCALNET>..19.244':445
'<LOCALNET>..19.245':445
'<LOCALNET>..19.246':445
'<LOCALNET>..19.247':445
'<LOCALNET>..19.248':445
'<LOCALNET>..19.249':445
'<LOCALNET>..19.250':445
'<LOCALNET>..19.251':445
'<LOCALNET>..19.252':445
'<LOCALNET>..19.253':445
'<LOCALNET>..19.254':445

Miscellaneous

Searches for the following windows

ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'EVERYTHING_TASKBAR_NOTIFICATION' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\7za.exe' i
'%TEMP%\7zipsfx.000\7za.exe' x -y -p21298231611253023752 Everything64.dll
'%TEMP%\7zipsfx.000\istanbul.exe'
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe'
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\everything.exe' -startup
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe' -e watch -pid 2380 -!
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe' -e ul2
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe' -e ul1

Executes the following

'<SYSTEM32>\powercfg.exe' -H off
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
'%TEMP%\7zipsfx.000\7za.exe' i' (with hidden window)
'%TEMP%\7zipsfx.000\7za.exe' x -y -p21298231611253023752 Everything64.dll' (with hidden window)
'%TEMP%\7zipsfx.000\istanbul.exe' ' (with hidden window)
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe' ' (with hidden window)
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\everything.exe' -startup' (with hidden window)
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe' -e watch -pid 2380 -!' (with hidden window)
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe' -e ul2' (with hidden window)
'%LOCALAPPDATA%\24a6c86b-03af-d04e-0dbe-2d770b52c1b0\chrome.exe' -e ul1' (with hidden window)
'<SYSTEM32>\powercfg.exe' -H off' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial