Trojan.Siggen10.37054

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\j733w8131Jii] 'ImagePath' = '%WINDIR%\SysWOW64\j733w8131Jii.sys'
[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Creates the following services

'j733w8131Jii' %WINDIR%\SysWOW64\j733w8131Jii.sys

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Injects code into

the following system processes:

<SYSTEM32>\wbem\wmiprvse.exe

Modifies file system

Creates the following files

%WINDIR%\icbbgl\dbbkdd.exe
%WINDIR%\syswow64\j733w8131jii.sys
%WINDIR%\svchost.exe
%WINDIR%\syswow64\zoqnly.exe
%WINDIR%\uguqiui.exe
%WINDIR%\icbbgl\znbnuf.dll
%WINDIR%\icbbgl\rcrbe\uslji.exe
%TEMP%\zhzxnlj.txt
%WINDIR%\icbbgl\ccpsqz.exe
%WINDIR%\0xcjcy_q.dll
%WINDIR%\icbbgl\rcrbe\uslji.txt
%WINDIR%\combat.vbs
%WINDIR%\appcom32.dll
%WINDIR%\icbbgl\clean.vbs
%WINDIR%\icbbgl\gmmxk\hprko.exe
%WINDIR%\icbbgl\xplbd\bxggv.exe
%WINDIR%\uu17szizd.dll
%TEMP%\ecqxkuk.txt
%WINDIR%\w6gyfms.dll
%WINDIR%\icbbgl\gmmxk\hprko.txt
%WINDIR%\icbbgl\lzofr\hvmhc.exe
%TEMP%\dcsivzb.txt
%WINDIR%\icbbgl\xplbd\bxggv.txt
%WINDIR%\icbbgl\lzofr\hvmhc.txt
%WINDIR%\icbbgl\flist.bin
%WINDIR%\icbbgl\nuzuje.dll
%WINDIR%\icbbgl\aipxvp.dll
%TEMP%\uadaera.txt
%TEMP%\faeaf17d554ad2ded894af11243d8b303aeb8.tmp

Sets the 'hidden' attribute to the following files

%WINDIR%\w6gyfms.dll
%WINDIR%\uu17szizd.dll
%WINDIR%\0xcjcy_q.dll

Deletes the following files

%WINDIR%\icbbgl\flist.bin
%WINDIR%\icbbgl\xplbd\bxggv.exe
%WINDIR%\icbbgl\ccpsqz.exe
%WINDIR%\syswow64\zoqnly.exe
%WINDIR%\icbbgl\clean.vbs
%WINDIR%\icbbgl\rcrbe\uslji.exe
%WINDIR%\uguqiui.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\get_ip[1].htm

Modifies the HOSTS file.

Deletes itself.

Network activity

Connects to

'cd#.#utaopt.cn':80

TCP

HTTP GET requests

http://lm.##wangba.com/GetCfg?V=###########################################################
http://cd#.#oluobl.cn/appi/appi/lashushu
http://21#.##0.218.154:808/hangzhoubd.exe via 21#.#50.218.154
http://10#.##.213.120:808/p5/p5.bin via 10#.#9.213.120
http://xf.###ospital.com/pap/t20200928.txt?ve############################################################################################################
http://cd#.#goutt.com/appi/appi/bba01
http://10#.##.213.120:808/ip.php via 10#.#9.213.120
http://wx#.#inaimg.cn/large/0082blolly1gjkgt647l8g300g00gncn.gif
http://ap##.#ame.qq.com/comm-htdocs/ip/get_ip.php
http://22#.###.173.236:9191/static/businessPackage/dll/yewu03mr.dll via 22#.#86.173.236
http://22#.###.173.236:9191/static/businessPackage/dll/yewu02mr.dll via 22#.#86.173.236
http://xf.###ospital.com/pap/f20200911.txt?ve############################################################################################################
http://22#.###.173.236:9191/static/businessPackage/userConfig/58js2496_1.ini via 22#.#86.173.236
http://bd.###ospital.com/other/ComApp20201010.txt?ve############################################################################################################
http://xf.###ospital.com/yjs/58js2496.txt?ve############################################################################################################
http://22#.###.173.236:9191/static/businessPackage/dll/yewu04mr.dll via 22#.#86.173.236
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

HTTP POST requests

http://47.##.143.174/AddReport
http://10#.##.213.120:808/p5/install.php via 10#.#9.213.120
http://rt.##.360down.cn/addCom
http://da##.58pap.com/addATP

'sp#.#aidu.com':443

'sd#####gfg.xyzs666.xyz':2653

UDP

DNS ASK lm.##wangba.com
DNS ASK sd#####gfg.xyzs666.xyz
DNS ASK cl####.fkchuanw.club
DNS ASK re#####.fkchuanw.club
DNS ASK ta##ao.com
DNS ASK da##.58pap.com
DNS ASK qy###tbzwimm
DNS ASK cd#.#oluobl.cn
DNS ASK wx#.#inaimg.cn
DNS ASK rt.##.360down.cn
DNS ASK sp#.#aidu.com
DNS ASK cd#.#goutt.com
DNS ASK ap##.#ame.qq.com
DNS ASK bd.###ospital.com
DNS ASK microsoft.com
DNS ASK cd#.#utaopt.cn
DNS ASK xf.###ospital.com
'<LOCALNET>.25.187':6582
'<LOCALNET>.25.185':6582
'<LOCALNET>.25.184':6582
'<LOCALNET>.25.183':6582
'<LOCALNET>.25.182':6582
'<LOCALNET>.25.178':6582
'<LOCALNET>.25.180':6582
'<LOCALNET>.25.179':6582
'<LOCALNET>.25.177':6582
'<LOCALNET>.25.176':6582
'<LOCALNET>.25.190':6582
'<LOCALNET>.25.181':6582
'<LOCALNET>.25.188':6582
'<LOCALNET>.25.197':6582
'<LOCALNET>.25.191':6582
'<LOCALNET>.25.192':6582
'<LOCALNET>.25.193':6582
'<LOCALNET>.25.194':6582
'<LOCALNET>.25.195':6582
'<LOCALNET>.25.196':6582
'<LOCALNET>.25.7':6580
'<LOCALNET>.25.198':6582
'<LOCALNET>.25.199':6582
'<LOCALNET>.25.200':6582
'<LOCALNET>.25.201':6582
'<LOCALNET>.25.175':6582
'<LOCALNET>.25.189':6582
'<LOCALNET>.25.204':6582
'<LOCALNET>.25.166':6582
'<LOCALNET>.25.171':6582
'<LOCALNET>.25.146':6582
'<LOCALNET>.25.147':6582
'<LOCALNET>.25.148':6582
'<LOCALNET>.25.149':6582
'<LOCALNET>.25.150':6582
'<LOCALNET>.25.151':6582
'<LOCALNET>.25.152':6582
'<LOCALNET>.25.153':6582
'<LOCALNET>.25.154':6582
'<LOCALNET>.25.155':6582
'<LOCALNET>.25.156':6582
'<LOCALNET>.25.174':6582
'<LOCALNET>.25.205':6582
'<LOCALNET>.25.157':6582
'<LOCALNET>.25.160':6582
'<LOCALNET>.25.161':6582
'<LOCALNET>.25.162':6582
'<LOCALNET>.25.163':6582
'<LOCALNET>.25.164':6582
'<LOCALNET>.25.165':6582
'<LOCALNET>.25.159':6582
'<LOCALNET>.25.167':6582
'<LOCALNET>.25.168':6582
'<LOCALNET>.25.169':6582
'<LOCALNET>.25.170':6582
'<LOCALNET>.25.173':6582
'<LOCALNET>.25.158':6582
'<LOCALNET>.25.145':6582
'<LOCALNET>.25.215':6582
'<LOCALNET>.25.209':6582
'<LOCALNET>.25.243':6582
'<LOCALNET>.25.244':6582
'<LOCALNET>.25.245':6582
'<LOCALNET>.25.246':6582
'<LOCALNET>.25.247':6582
'<LOCALNET>.25.248':6582
'<LOCALNET>.25.249':6582
'<LOCALNET>.25.250':6582
'<LOCALNET>.25.251':6582
'<LOCALNET>.25.252':6582
'<LOCALNET>.25.253':6582
'<LOCALNET>.25.254':6582
'<LOCALNET>.25.208':6582
'<LOCALNET>.25.242':6582
'<LOCALNET>.25.3':6583
'<LOCALNET>.25.4':6583
'<LOCALNET>.25.5':6583
'<LOCALNET>.25.6':6583
'<LOCALNET>.25.7':6583
'<LOCALNET>.25.8':6583
'<LOCALNET>.25.9':6583
'<LOCALNET>.25.10':6583
'<LOCALNET>.25.11':6583
'<LOCALNET>.25.12':6583
'<LOCALNET>.25.13':6583
'<LOCALNET>.25.14':6583
'<LOCALNET>.25.1':6583
'<LOCALNET>.25.206':6582
'<LOCALNET>.25.2':6583
'<LOCALNET>.25.241':6582
'<LOCALNET>.25.210':6582
'<LOCALNET>.25.211':6582
'<LOCALNET>.25.212':6582
'<LOCALNET>.25.213':6582
'<LOCALNET>.25.214':6582
'<LOCALNET>.25.172':6582
'<LOCALNET>.25.216':6582
'<LOCALNET>.25.217':6582
'<LOCALNET>.25.218':6582
'<LOCALNET>.25.219':6582
'<LOCALNET>.25.220':6582
'<LOCALNET>.25.239':6582
'<LOCALNET>.25.207':6582
'<LOCALNET>.25.240':6582
'<LOCALNET>.25.224':6582
'<LOCALNET>.25.225':6582
'<LOCALNET>.25.226':6582
'<LOCALNET>.25.231':6582
'<LOCALNET>.25.232':6582
'<LOCALNET>.25.233':6582
'<LOCALNET>.25.234':6582
'<LOCALNET>.25.235':6582
'<LOCALNET>.25.236':6582
'<LOCALNET>.25.237':6582
'<LOCALNET>.25.238':6582
'<LOCALNET>.25.221':6582
'<LOCALNET>.25.223':6582
'<LOCALNET>.25.222':6582
'<LOCALNET>.25.133':6582
'<LOCALNET>.25.144':6582
'<LOCALNET>.25.50':6582
'<LOCALNET>.25.51':6582
'<LOCALNET>.25.52':6582
'<LOCALNET>.25.53':6582
'<LOCALNET>.25.54':6582
'<LOCALNET>.25.55':6582
'<LOCALNET>.25.56':6582
'<LOCALNET>.25.57':6582
'<LOCALNET>.25.58':6582
'<LOCALNET>.25.59':6582
'<LOCALNET>.25.60':6582
'<LOCALNET>.25.75':6582
'<LOCALNET>.25.49':6582
'<LOCALNET>.25.48':6582
'<LOCALNET>.25.64':6582
'<LOCALNET>.25.65':6582
'<LOCALNET>.25.66':6582
'<LOCALNET>.25.67':6582
'<LOCALNET>.25.68':6582
'<LOCALNET>.25.69':6582
'<LOCALNET>.25.70':6582
'<LOCALNET>.25.71':6582
'<LOCALNET>.25.72':6582
'<LOCALNET>.25.73':6582
'<LOCALNET>.25.74':6582
'<LOCALNET>.25.61':6582
'<LOCALNET>.25.63':6582
'<LOCALNET>.25.142':6582
'<LOCALNET>.25.62':6582
'<LOCALNET>.25.28':6582
'<LOCALNET>.25.14':6582
'<LOCALNET>.25.15':6582
'<LOCALNET>.25.16':6582
'<LOCALNET>.25.19':6582
'<LOCALNET>.25.20':6582
'<LOCALNET>.25.21':6582
'<LOCALNET>.25.22':6582
'<LOCALNET>.25.23':6582
'<LOCALNET>.25.24':6582
'<LOCALNET>.25.25':6582
'<LOCALNET>.25.26':6582
'<LOCALNET>.25.41':6582
'<LOCALNET>.25.47':6582
'<LOCALNET>.25.42':6582
'<LOCALNET>.25.30':6582
'<LOCALNET>.25.31':6582
'<LOCALNET>.25.32':6582
'<LOCALNET>.25.33':6582
'<LOCALNET>.25.34':6582
'<LOCALNET>.25.35':6582
'<LOCALNET>.25.36':6582
'<LOCALNET>.25.37':6582
'<LOCALNET>.25.38':6582
'<LOCALNET>.25.39':6582
'<LOCALNET>.25.40':6582
'<LOCALNET>.25.27':6582
'<LOCALNET>.25.29':6582
'<LOCALNET>.25.15':6583
'<LOCALNET>.25.143':6582
'<LOCALNET>.25.79':6582
'<LOCALNET>.25.113':6582
'<LOCALNET>.25.114':6582
'<LOCALNET>.25.115':6582
'<LOCALNET>.25.116':6582
'<LOCALNET>.25.117':6582
'<LOCALNET>.25.118':6582
'<LOCALNET>.25.119':6582
'<LOCALNET>.25.120':6582
'<LOCALNET>.25.121':6582
'<LOCALNET>.25.122':6582
'<LOCALNET>.25.123':6582
'<LOCALNET>.25.77':6582
'<LOCALNET>.25.112':6582
'<LOCALNET>.25.109':6582
'<LOCALNET>.25.127':6582
'<LOCALNET>.25.128':6582
'<LOCALNET>.25.129':6582
'<LOCALNET>.25.130':6582
'<LOCALNET>.25.131':6582
'<LOCALNET>.25.132':6582
'<LOCALNET>.25.92':6582
'<LOCALNET>.25.134':6582
'<LOCALNET>.25.139':6582
'<LOCALNET>.25.140':6582
'<LOCALNET>.25.141':6582
'<LOCALNET>.25.124':6582
'<LOCALNET>.25.126':6582
'<LOCALNET>.25.78':6582
'<LOCALNET>.25.125':6582
'<LOCALNET>.25.76':6582
'<LOCALNET>.25.80':6582
'<LOCALNET>.25.81':6582
'<LOCALNET>.25.82':6582
'<LOCALNET>.25.83':6582
'<LOCALNET>.25.84':6582
'<LOCALNET>.25.85':6582
'<LOCALNET>.25.86':6582
'<LOCALNET>.25.87':6582
'<LOCALNET>.25.88':6582
'<LOCALNET>.25.89':6582
'<LOCALNET>.25.90':6582
'<LOCALNET>.25.106':6582
'<LOCALNET>.25.108':6582
'<LOCALNET>.25.107':6582
'<LOCALNET>.25.95':6582
'<LOCALNET>.25.96':6582
'<LOCALNET>.25.97':6582
'<LOCALNET>.25.98':6582
'<LOCALNET>.25.99':6582
'<LOCALNET>.25.100':6582
'<LOCALNET>.25.101':6582
'<LOCALNET>.25.102':6582
'<LOCALNET>.25.103':6582
'<LOCALNET>.25.104':6582
'<LOCALNET>.25.105':6582
'<LOCALNET>.25.91':6582
'<LOCALNET>.25.93':6582
'<LOCALNET>.25.6':6580
'<LOCALNET>.25.27':6583
'<LOCALNET>.25.18':6583
'<LOCALNET>.25.182':6583
'<LOCALNET>.25.183':6583
'<LOCALNET>.25.184':6583
'<LOCALNET>.25.185':6583
'<LOCALNET>.25.186':6583
'<LOCALNET>.25.187':6583
'<LOCALNET>.25.188':6583
'<LOCALNET>.25.189':6583
'<LOCALNET>.25.190':6583
'<LOCALNET>.25.191':6583
'<LOCALNET>.25.192':6583
'<LOCALNET>.25.208':6583
'<LOCALNET>.25.181':6583
'<LOCALNET>.25.180':6583
'<LOCALNET>.25.196':6583
'<LOCALNET>.25.197':6583
'<LOCALNET>.25.198':6583
'<LOCALNET>.25.199':6583
'<LOCALNET>.25.200':6583
'<LOCALNET>.25.201':6583
'<LOCALNET>.25.202':6583
'<LOCALNET>.25.203':6583
'<LOCALNET>.25.204':6583
'<LOCALNET>.25.205':6583
'<LOCALNET>.25.207':6583
'<LOCALNET>.25.193':6583
'<LOCALNET>.25.195':6583
'<LOCALNET>.25.146':6583
'<LOCALNET>.25.194':6583
'<LOCALNET>.25.164':6583
'<LOCALNET>.25.148':6583
'<LOCALNET>.25.149':6583
'<LOCALNET>.25.150':6583
'<LOCALNET>.25.151':6583
'<LOCALNET>.25.152':6583
'<LOCALNET>.25.153':6583
'<LOCALNET>.25.154':6583
'<LOCALNET>.25.159':6583
'<LOCALNET>.25.160':6583
'<LOCALNET>.25.161':6583
'<LOCALNET>.25.162':6583
'<LOCALNET>.25.177':6583
'<LOCALNET>.25.179':6583
'<LOCALNET>.25.178':6583
'<LOCALNET>.25.166':6583
'<LOCALNET>.25.167':6583
'<LOCALNET>.25.168':6583
'<LOCALNET>.25.169':6583
'<LOCALNET>.25.170':6583
'<LOCALNET>.25.171':6583
'<LOCALNET>.25.172':6583
'<LOCALNET>.25.173':6583
'<LOCALNET>.25.174':6583
'<LOCALNET>.25.175':6583
'<LOCALNET>.25.176':6583
'<LOCALNET>.25.163':6583
'<LOCALNET>.25.165':6583
'<LOCALNET>.25.147':6583
'<LOCALNET>.25.209':6583
'<LOCALNET>.25.213':6583
'<LOCALNET>.25.245':6583
'<LOCALNET>.25.246':6583
'<LOCALNET>.25.251':6583
'<LOCALNET>.25.252':6583
'<LOCALNET>.25.253':6583
'<LOCALNET>.25.254':6583
'<LOCALNET>.25.1':6584
'<LOCALNET>.25.2':6584
'<LOCALNET>.25.3':6584
'<LOCALNET>.25.4':6584
'<LOCALNET>.25.4':6580
'<LOCALNET>.25.243':6583
'<LOCALNET>.25.244':6583
'<LOCALNET>.25.3':6580
'<LOCALNET>.25.255':6589
'<LOCALNET>.25.255':6588
'<LOCALNET>.25.255':6587
'<LOCALNET>.25.255':6586
'<LOCALNET>.25.255':6585
'<LOCALNET>.25.255':6584
'<LOCALNET>.25.255':6583
'<LOCALNET>.25.255':6582
'<LOCALNET>.25.255':6581
're#####.fkchuanw.club':23002
'<LOCALNET>.25.255':6580
'<LOCALNET>.25.2':6580
'<LOCALNET>.25.1':6580
'<LOCALNET>.25.211':6583
'<LOCALNET>.25.210':6583
'<LOCALNET>.25.240':6583
'<LOCALNET>.25.214':6583
'<LOCALNET>.25.215':6583
'<LOCALNET>.25.216':6583
'<LOCALNET>.25.217':6583
'<LOCALNET>.25.218':6583
'<LOCALNET>.25.219':6583
'<LOCALNET>.25.220':6583
'<LOCALNET>.25.221':6583
'<LOCALNET>.25.224':6583
'<LOCALNET>.25.225':6583
'<LOCALNET>.25.241':6583
'<LOCALNET>.25.212':6583
'<LOCALNET>.25.242':6583
'<LOCALNET>.25.226':6583
'<LOCALNET>.25.230':6583
'<LOCALNET>.25.231':6583
'<LOCALNET>.25.232':6583
'<LOCALNET>.25.233':6583
'<LOCALNET>.25.234':6583
'<LOCALNET>.25.235':6583
'<LOCALNET>.25.236':6583
'<LOCALNET>.25.237':6583
'<LOCALNET>.25.238':6583
'<LOCALNET>.25.239':6583
'<LOCALNET>.25.227':6583
'<LOCALNET>.25.228':6583
'<LOCALNET>.25.229':6583
'<LOCALNET>.25.145':6583
'<LOCALNET>.25.144':6583
'<LOCALNET>.25.143':6583
'<LOCALNET>.25.53':6583
'<LOCALNET>.25.54':6583
'<LOCALNET>.25.55':6583
'<LOCALNET>.25.56':6583
'<LOCALNET>.25.57':6583
'<LOCALNET>.25.58':6583
'<LOCALNET>.25.59':6583
'<LOCALNET>.25.60':6583
'<LOCALNET>.25.61':6583
'<LOCALNET>.25.62':6583
'<LOCALNET>.25.63':6583
'<LOCALNET>.25.51':6583
'<LOCALNET>.25.80':6583
'<LOCALNET>.25.50':6583
'<LOCALNET>.25.69':6583
'<LOCALNET>.25.70':6583
'<LOCALNET>.25.71':6583
'<LOCALNET>.25.72':6583
'<LOCALNET>.25.73':6583
'<LOCALNET>.25.74':6583
'<LOCALNET>.25.75':6583
'<LOCALNET>.25.76':6583
'<LOCALNET>.25.77':6583
'<LOCALNET>.25.78':6583
'<LOCALNET>.25.79':6583
'<LOCALNET>.25.65':6583
'<LOCALNET>.25.64':6583
'<LOCALNET>.25.68':6583
'<LOCALNET>.25.48':6583
'<LOCALNET>.25.34':6583
'<LOCALNET>.25.20':6583
'<LOCALNET>.25.21':6583
'<LOCALNET>.25.22':6583
'<LOCALNET>.25.23':6583
'<LOCALNET>.25.24':6583
'<LOCALNET>.25.26':6583
'<LOCALNET>.25.13':6582
'<LOCALNET>.25.28':6583
'<LOCALNET>.25.29':6583
'<LOCALNET>.25.30':6583
'<LOCALNET>.25.31':6583
'<LOCALNET>.25.49':6583
'<LOCALNET>.25.81':6583
'<LOCALNET>.25.19':6583
'<LOCALNET>.25.35':6583
'<LOCALNET>.25.36':6583
'<LOCALNET>.25.37':6583
'<LOCALNET>.25.38':6583
'<LOCALNET>.25.39':6583
'<LOCALNET>.25.40':6583
'<LOCALNET>.25.43':6583
'<LOCALNET>.25.44':6583
'<LOCALNET>.25.45':6583
'<LOCALNET>.25.46':6583
'<LOCALNET>.25.47':6583
'<LOCALNET>.25.33':6583
'<LOCALNET>.25.32':6583
'<LOCALNET>.25.52':6583
'<LOCALNET>.25.82':6583
'<LOCALNET>.25.116':6583
'<LOCALNET>.25.118':6583
'<LOCALNET>.25.119':6583
'<LOCALNET>.25.120':6583
'<LOCALNET>.25.121':6583
'<LOCALNET>.25.122':6583
'<LOCALNET>.25.123':6583
'<LOCALNET>.25.124':6583
'<LOCALNET>.25.125':6583
'<LOCALNET>.25.126':6583
'<LOCALNET>.25.127':6583
'<LOCALNET>.25.114':6583
'<LOCALNET>.25.112':6583
'<LOCALNET>.25.117':6583
'<LOCALNET>.25.128':6583
'<LOCALNET>.25.133':6583
'<LOCALNET>.25.134':6583
'<LOCALNET>.25.135':6583
'<LOCALNET>.25.136':6583
'<LOCALNET>.25.137':6583
'<LOCALNET>.25.138':6583
'<LOCALNET>.25.139':6583
'<LOCALNET>.25.140':6583
'<LOCALNET>.25.141':6583
'<LOCALNET>.25.142':6583
'<LOCALNET>.25.129':6583
'<LOCALNET>.25.130':6583
'<LOCALNET>.25.132':6583
'<LOCALNET>.25.113':6583
'<LOCALNET>.25.111':6583
'<LOCALNET>.25.83':6583
'<LOCALNET>.25.85':6583
'<LOCALNET>.25.86':6583
'<LOCALNET>.25.87':6583
'<LOCALNET>.25.88':6583
'<LOCALNET>.25.89':6583
'<LOCALNET>.25.90':6583
'<LOCALNET>.25.91':6583
'<LOCALNET>.25.92':6583
'<LOCALNET>.25.93':6583
'<LOCALNET>.25.94':6583
'<LOCALNET>.25.95':6583
'<LOCALNET>.25.96':6583
'<LOCALNET>.25.84':6583
'<LOCALNET>.25.97':6583
'<LOCALNET>.25.99':6583
'<LOCALNET>.25.100':6583
'<LOCALNET>.25.101':6583
'<LOCALNET>.25.102':6583
'<LOCALNET>.25.103':6583
'<LOCALNET>.25.10':6582
'<LOCALNET>.25.105':6583
'<LOCALNET>.25.106':6583
'<LOCALNET>.25.107':6583
'<LOCALNET>.25.108':6583
'<LOCALNET>.25.109':6583
'<LOCALNET>.25.110':6583
'<LOCALNET>.25.98':6583
'<LOCALNET>.25.16':6583
'<LOCALNET>.25.12':6582
'<LOCALNET>.25.4':6582
'<LOCALNET>.25.11':6582
'<LOCALNET>.25.165':6580
'<LOCALNET>.25.166':6580
'<LOCALNET>.25.167':6580
'<LOCALNET>.25.168':6580
'<LOCALNET>.25.169':6580
'<LOCALNET>.25.170':6580
'<LOCALNET>.25.171':6580
'<LOCALNET>.25.172':6580
'<LOCALNET>.25.173':6580
'<LOCALNET>.25.174':6580
'<LOCALNET>.25.175':6580
'<LOCALNET>.25.194':6580
'<LOCALNET>.25.164':6580
'<LOCALNET>.25.163':6580
'<LOCALNET>.25.183':6580
'<LOCALNET>.25.184':6580
'<LOCALNET>.25.185':6580
'<LOCALNET>.25.186':6580
'<LOCALNET>.25.187':6580
'<LOCALNET>.25.188':6580
'<LOCALNET>.25.189':6580
'<LOCALNET>.25.190':6580
'<LOCALNET>.25.191':6580
'<LOCALNET>.25.192':6580
'<LOCALNET>.25.193':6580
'<LOCALNET>.25.176':6580
'<LOCALNET>.25.178':6580
'<LOCALNET>.25.3':6581
'<LOCALNET>.25.177':6580
'<LOCALNET>.25.145':6580
'<LOCALNET>.25.132':6580
'<LOCALNET>.25.133':6580
'<LOCALNET>.25.134':6580
'<LOCALNET>.25.135':6580
'<LOCALNET>.25.136':6580
'<LOCALNET>.25.137':6580
'<LOCALNET>.25.139':6580
'<LOCALNET>.25.140':6580
'<LOCALNET>.25.141':6580
'<LOCALNET>.25.142':6580
'<LOCALNET>.25.143':6580
'<LOCALNET>.25.160':6580
'<LOCALNET>.25.162':6580
'<LOCALNET>.25.161':6580
'<LOCALNET>.25.147':6580
'<LOCALNET>.25.148':6580
'<LOCALNET>.25.149':6580
'<LOCALNET>.25.150':6580
'<LOCALNET>.25.151':6580
'<LOCALNET>.25.152':6580
'<LOCALNET>.25.153':6580
'<LOCALNET>.25.156':6580
'<LOCALNET>.25.157':6580
'<LOCALNET>.25.158':6580
'<LOCALNET>.25.159':6580
'<LOCALNET>.25.144':6580
'<LOCALNET>.25.146':6580
'<LOCALNET>.25.131':6580
'<LOCALNET>.25.130':6580
'<LOCALNET>.25.198':6580
'<LOCALNET>.25.229':6580
'<LOCALNET>.25.231':6580
'<LOCALNET>.25.232':6580
'<LOCALNET>.25.233':6580
'<LOCALNET>.25.234':6580
'<LOCALNET>.25.235':6580
'<LOCALNET>.25.236':6580
'<LOCALNET>.25.237':6580
'<LOCALNET>.25.238':6580
'<LOCALNET>.25.239':6580
'<LOCALNET>.25.240':6580
'<LOCALNET>.25.196':6580
'<LOCALNET>.25.228':6580
'<LOCALNET>.25.227':6580
'<LOCALNET>.25.244':6580
'<LOCALNET>.25.245':6580
'<LOCALNET>.25.248':6580
'<LOCALNET>.25.249':6580
'<LOCALNET>.25.250':6580
'<LOCALNET>.25.251':6580
'<LOCALNET>.25.252':6580
'<LOCALNET>.25.253':6580
'<LOCALNET>.25.254':6580
'<LOCALNET>.25.1':6581
'<LOCALNET>.25.2':6581
'<LOCALNET>.25.241':6580
'<LOCALNET>.25.243':6580
'<LOCALNET>.25.197':6580
'<LOCALNET>.25.242':6580
'<LOCALNET>.25.195':6580
'<LOCALNET>.25.199':6580
'<LOCALNET>.25.200':6580
'<LOCALNET>.25.201':6580
'<LOCALNET>.25.202':6580
'<LOCALNET>.25.203':6580
'<LOCALNET>.25.204':6580
'<LOCALNET>.25.205':6580
'<LOCALNET>.25.206':6580
'<LOCALNET>.25.207':6580
'<LOCALNET>.25.208':6580
'<LOCALNET>.25.209':6580
'<LOCALNET>.25.224':6580
'<LOCALNET>.25.226':6580
'<LOCALNET>.25.225':6580
'<LOCALNET>.25.213':6580
'<LOCALNET>.25.214':6580
'<LOCALNET>.25.215':6580
'<LOCALNET>.25.216':6580
'<LOCALNET>.25.217':6580
'<LOCALNET>.25.81':6580
'<LOCALNET>.25.219':6580
'<LOCALNET>.25.220':6580
'<LOCALNET>.25.221':6580
'<LOCALNET>.25.222':6580
'<LOCALNET>.25.223':6580
'<LOCALNET>.25.210':6580
'<LOCALNET>.25.212':6580
'<LOCALNET>.25.211':6580
'<LOCALNET>.25.218':6580
'<LOCALNET>.25.129':6580
'<LOCALNET>.25.38':6580
'<LOCALNET>.25.39':6580
'<LOCALNET>.25.40':6580
'<LOCALNET>.25.41':6580
'<LOCALNET>.25.42':6580
'<LOCALNET>.25.43':6580
'<LOCALNET>.25.44':6580
'<LOCALNET>.25.45':6580
'<LOCALNET>.25.46':6580
'<LOCALNET>.25.47':6580
'<LOCALNET>.25.48':6580
'<LOCALNET>.25.49':6580
'<LOCALNET>.25.51':6580
'<LOCALNET>.25.64':6580
'<LOCALNET>.25.52':6580
'<LOCALNET>.25.53':6580
'<LOCALNET>.25.54':6580
'<LOCALNET>.25.55':6580
'<LOCALNET>.25.56':6580
'<LOCALNET>.25.57':6580
'<LOCALNET>.25.21':6580
'<LOCALNET>.25.59':6580
'<LOCALNET>.25.60':6580
'<LOCALNET>.25.61':6580
'<LOCALNET>.25.62':6580
'<LOCALNET>.25.63':6580
'<LOCALNET>.25.37':6580
'<LOCALNET>.25.50':6580
'<LOCALNET>.25.58':6580
'<LOCALNET>.25.20':6580
'<LOCALNET>.25.18':6580
'<LOCALNET>.25.17':6580
'<LOCALNET>.25.16':6580
'<LOCALNET>.25.15':6580
'<LOCALNET>.25.14':6580
'<LOCALNET>.25.10':6580
'<LOCALNET>.25.12':6580
'<LOCALNET>.25.11':6580
'<LOCALNET>.25.9':6580
'<LOCALNET>.25.8':6580
'<LOCALNET>.25.19':6580
'<LOCALNET>.25.13':6580
'<LOCALNET>.25.36':6580
'<LOCALNET>.25.35':6580
'<LOCALNET>.25.22':6580
'<LOCALNET>.25.23':6580
'<LOCALNET>.25.24':6580
'<LOCALNET>.25.25':6580
'<LOCALNET>.25.26':6580
'<LOCALNET>.25.27':6580
'<LOCALNET>.25.34':6580
'<LOCALNET>.25.29':6580
'<LOCALNET>.25.30':6580
'<LOCALNET>.25.31':6580
'<LOCALNET>.25.32':6580
'<LOCALNET>.25.33':6580
'<LOCALNET>.25.28':6580
'<LOCALNET>.25.128':6580
'<LOCALNET>.25.106':6580
'<LOCALNET>.25.67':6580
'<LOCALNET>.25.102':6580
'<LOCALNET>.25.103':6580
'<LOCALNET>.25.104':6580
'<LOCALNET>.25.105':6580
'<LOCALNET>.25.127':6580
'<LOCALNET>.25.107':6580
'<LOCALNET>.25.108':6580
'<LOCALNET>.25.109':6580
'<LOCALNET>.25.110':6580
'<LOCALNET>.25.111':6580
'<LOCALNET>.25.112':6580
'<LOCALNET>.25.66':6580
'<LOCALNET>.25.101':6580
'<LOCALNET>.25.100':6580
'<LOCALNET>.25.116':6580
'<LOCALNET>.25.117':6580
'<LOCALNET>.25.118':6580
'<LOCALNET>.25.119':6580
'<LOCALNET>.25.120':6580
'<LOCALNET>.25.121':6580
'<LOCALNET>.25.122':6580
'<LOCALNET>.25.123':6580
'<LOCALNET>.25.124':6580
'<LOCALNET>.25.125':6580
'<LOCALNET>.25.126':6580
'<LOCALNET>.25.113':6580
'<LOCALNET>.25.115':6580
'<LOCALNET>.25.114':6580
'<LOCALNET>.25.99':6580
'<LOCALNET>.25.65':6580
'<LOCALNET>.25.68':6580
'<LOCALNET>.25.69':6580
'<LOCALNET>.25.70':6580
'<LOCALNET>.25.71':6580
'<LOCALNET>.25.72':6580
'<LOCALNET>.25.73':6580
'<LOCALNET>.25.74':6580
'<LOCALNET>.25.75':6580
'<LOCALNET>.25.76':6580
'<LOCALNET>.25.77':6580
'<LOCALNET>.25.78':6580
'<LOCALNET>.25.79':6580
'<LOCALNET>.25.97':6580
'<LOCALNET>.25.98':6580
'<LOCALNET>.25.82':6580
'<LOCALNET>.25.83':6580
'<LOCALNET>.25.84':6580
'<LOCALNET>.25.85':6580
'<LOCALNET>.25.86':6580
'<LOCALNET>.25.87':6580
'<LOCALNET>.25.91':6580
'<LOCALNET>.25.92':6580
'<LOCALNET>.25.93':6580
'<LOCALNET>.25.94':6580
'<LOCALNET>.25.95':6580
'<LOCALNET>.25.96':6580
'<LOCALNET>.25.80':6580
'<LOCALNET>.25.4':6581
'<LOCALNET>.25.104':6583
'<LOCALNET>.25.176':6581
'<LOCALNET>.25.8':6581
'<LOCALNET>.25.172':6581
'<LOCALNET>.25.173':6581
'<LOCALNET>.25.174':6581
'<LOCALNET>.25.175':6581
'<LOCALNET>.25.9':6582
'<LOCALNET>.25.177':6581
'<LOCALNET>.25.180':6581
'<LOCALNET>.25.181':6581
'<LOCALNET>.25.182':6581
'<LOCALNET>.25.183':6581
'<LOCALNET>.25.198':6581
'<LOCALNET>.25.169':6581
'<LOCALNET>.25.171':6581
'<LOCALNET>.25.186':6581
'<LOCALNET>.25.188':6581
'<LOCALNET>.25.189':6581
'<LOCALNET>.25.190':6581
'<LOCALNET>.25.191':6581
'<LOCALNET>.25.192':6581
'<LOCALNET>.25.193':6581
'<LOCALNET>.25.194':6581
'<LOCALNET>.25.195':6581
'<LOCALNET>.25.196':6581
'<LOCALNET>.25.197':6581
'<LOCALNET>.25.184':6581
'<LOCALNET>.25.138':6581
'<LOCALNET>.25.187':6581
'<LOCALNET>.25.199':6581
'<LOCALNET>.25.170':6581
'<LOCALNET>.25.168':6581
'<LOCALNET>.25.141':6581
'<LOCALNET>.25.142':6581
'<LOCALNET>.25.143':6581
'<LOCALNET>.25.144':6581
'<LOCALNET>.25.145':6581
'<LOCALNET>.25.146':6581
'<LOCALNET>.25.147':6581
'<LOCALNET>.25.148':6581
'<LOCALNET>.25.149':6581
'<LOCALNET>.25.150':6581
'<LOCALNET>.25.166':6581
'<LOCALNET>.25.167':6581
'<LOCALNET>.25.185':6581
'<LOCALNET>.25.153':6581
'<LOCALNET>.25.155':6581
'<LOCALNET>.25.156':6581
'<LOCALNET>.25.157':6581
'<LOCALNET>.25.158':6581
'<LOCALNET>.25.159':6581
'<LOCALNET>.25.160':6581
'<LOCALNET>.25.161':6581
'<LOCALNET>.25.163':6581
'<LOCALNET>.25.164':6581
'<LOCALNET>.25.165':6581
'<LOCALNET>.25.151':6581
'<LOCALNET>.25.152':6581
'<LOCALNET>.25.154':6581
'<LOCALNET>.25.140':6581
'<LOCALNET>.25.201':6581
'<LOCALNET>.25.208':6581
'<LOCALNET>.25.238':6581
'<LOCALNET>.25.239':6581
'<LOCALNET>.25.240':6581
'<LOCALNET>.25.241':6581
'<LOCALNET>.25.242':6581
'<LOCALNET>.25.243':6581
'<LOCALNET>.25.244':6581
'<LOCALNET>.25.245':6581
'<LOCALNET>.25.246':6581
'<LOCALNET>.25.247':6581
'<LOCALNET>.25.235':6581
'<LOCALNET>.25.248':6581
'<LOCALNET>.25.237':6581
'<LOCALNET>.25.250':6581
'<LOCALNET>.25.252':6581
'<LOCALNET>.25.253':6581
'<LOCALNET>.25.1':6582
'<LOCALNET>.25.5':6580
'<LOCALNET>.25.3':6582
'<LOCALNET>.25.17':6583
'<LOCALNET>.25.5':6582
'<LOCALNET>.25.6':6582
'<LOCALNET>.25.7':6582
'<LOCALNET>.25.8':6582
'<LOCALNET>.25.249':6581
'<LOCALNET>.25.5':6581
'<LOCALNET>.25.251':6581
'<LOCALNET>.25.207':6581
'<LOCALNET>.25.236':6581
'<LOCALNET>.25.234':6581
'<LOCALNET>.25.209':6581
'<LOCALNET>.25.210':6581
'<LOCALNET>.25.211':6581
'<LOCALNET>.25.212':6581
'<LOCALNET>.25.213':6581
'<LOCALNET>.25.214':6581
'<LOCALNET>.25.215':6581
'<LOCALNET>.25.216':6581
'<LOCALNET>.25.217':6581
'<LOCALNET>.25.233':6581
'<LOCALNET>.25.202':6581
'<LOCALNET>.25.218':6581
'<LOCALNET>.25.200':6581
'<LOCALNET>.25.221':6581
'<LOCALNET>.25.223':6581
'<LOCALNET>.25.224':6581
'<LOCALNET>.25.225':6581
'<LOCALNET>.25.226':6581
'<LOCALNET>.25.227':6581
'<LOCALNET>.25.228':6581
'<LOCALNET>.25.229':6581
'<LOCALNET>.25.230':6581
'<LOCALNET>.25.231':6581
'<LOCALNET>.25.219':6581
'<LOCALNET>.25.220':6581
'<LOCALNET>.25.232':6581
'<LOCALNET>.25.222':6581
'<LOCALNET>.25.139':6581
'<LOCALNET>.25.137':6581
'<LOCALNET>.25.136':6581
'<LOCALNET>.25.43':6581
'<LOCALNET>.25.44':6581
'<LOCALNET>.25.45':6581
'<LOCALNET>.25.46':6581
'<LOCALNET>.25.47':6581
'<LOCALNET>.25.48':6581
'<LOCALNET>.25.49':6581
'<LOCALNET>.25.50':6581
'<LOCALNET>.25.51':6581
'<LOCALNET>.25.52':6581
'<LOCALNET>.25.40':6581
'<LOCALNET>.25.39':6581
'<LOCALNET>.25.42':6581
'<LOCALNET>.25.53':6581
'<LOCALNET>.25.57':6581
'<LOCALNET>.25.58':6581
'<LOCALNET>.25.59':6581
'<LOCALNET>.25.60':6581
'<LOCALNET>.25.61':6581
'<LOCALNET>.25.62':6581
'<LOCALNET>.25.63':6581
'<LOCALNET>.25.64':6581
'<LOCALNET>.25.65':6581
'<LOCALNET>.25.66':6581
'<LOCALNET>.25.54':6581
'<LOCALNET>.25.55':6581
'<LOCALNET>.25.56':6581
'<LOCALNET>.25.41':6581
'<LOCALNET>.25.67':6581
'<LOCALNET>.25.68':6581
'<LOCALNET>.25.9':6581
'<LOCALNET>.25.10':6581
'<LOCALNET>.25.11':6581
'<LOCALNET>.25.12':6581
'<LOCALNET>.25.13':6581
'<LOCALNET>.25.14':6581
'<LOCALNET>.25.15':6581
'<LOCALNET>.25.16':6581
'<LOCALNET>.25.17':6581
'<LOCALNET>.25.22':6581
'<LOCALNET>.25.38':6581
'<LOCALNET>.25.7':6581
'<LOCALNET>.25.37':6581
'<LOCALNET>.25.23':6581
'<LOCALNET>.25.27':6581
'<LOCALNET>.25.28':6581
'<LOCALNET>.25.29':6581
'<LOCALNET>.25.30':6581
'<LOCALNET>.25.31':6581
'<LOCALNET>.25.32':6581
'<LOCALNET>.25.33':6581
'<LOCALNET>.25.34':6581
'<LOCALNET>.25.35':6581
'<LOCALNET>.25.36':6581
'<LOCALNET>.25.24':6581
'<LOCALNET>.25.25':6581
'<LOCALNET>.25.26':6581
'<LOCALNET>.25.69':6581
'<LOCALNET>.25.105':6581
'<LOCALNET>.25.73':6581
'<LOCALNET>.25.108':6581
'<LOCALNET>.25.109':6581
'<LOCALNET>.25.110':6581
'<LOCALNET>.25.115':6581
'<LOCALNET>.25.116':6581
'<LOCALNET>.25.117':6581
'<LOCALNET>.25.118':6581
'<LOCALNET>.25.119':6581
'<LOCALNET>.25.120':6581
'<LOCALNET>.25.104':6581
'<LOCALNET>.25.102':6581
'<LOCALNET>.25.121':6581
'<LOCALNET>.25.107':6581
'<LOCALNET>.25.124':6581
'<LOCALNET>.25.126':6581
'<LOCALNET>.25.127':6581
'<LOCALNET>.25.128':6581
'<LOCALNET>.25.129':6581
'<LOCALNET>.25.130':6581
'<LOCALNET>.25.131':6581
'<LOCALNET>.25.132':6581
'<LOCALNET>.25.133':6581
'<LOCALNET>.25.134':6581
'<LOCALNET>.25.122':6581
'<LOCALNET>.25.123':6581
'<LOCALNET>.25.135':6581
'<LOCALNET>.25.125':6581
'<LOCALNET>.25.106':6581
'<LOCALNET>.25.103':6581
'<LOCALNET>.25.101':6581
'<LOCALNET>.25.74':6581
'<LOCALNET>.25.75':6581
'<LOCALNET>.25.76':6581
'<LOCALNET>.25.77':6581
'<LOCALNET>.25.78':6581
'<LOCALNET>.25.79':6581
'<LOCALNET>.25.80':6581
'<LOCALNET>.25.81':6581
'<LOCALNET>.25.82':6581
'<LOCALNET>.25.83':6581
'<LOCALNET>.25.84':6581
'<LOCALNET>.25.72':6581
'<LOCALNET>.25.85':6581
'<LOCALNET>.25.89':6581
'<LOCALNET>.25.90':6581
'<LOCALNET>.25.91':6581
'<LOCALNET>.25.92':6581
'<LOCALNET>.25.93':6581
'<LOCALNET>.25.94':6581
'<LOCALNET>.25.95':6581
'<LOCALNET>.25.96':6581
'<LOCALNET>.25.97':6581
'<LOCALNET>.25.98':6581
'<LOCALNET>.25.99':6581
'<LOCALNET>.25.100':6581
'<LOCALNET>.25.88':6581
'<LOCALNET>.25.71':6581
'<LOCALNET>.25.6':6581
'<LOCALNET>.25.2':6582

Miscellaneous

Searches for the following windows

ClassName: 'RCLIENT' WindowName: 'League of Legends'

Creates and executes the following

'%WINDIR%\icbbgl\dbbkdd.exe'
'%WINDIR%\syswow64\wscript.exe' "%WINDIR%\icbbgl\clean.vbs"
'%WINDIR%\svchost.exe'
'%WINDIR%\syswow64\zoqnly.exe'
'%WINDIR%\icbbgl\ccpsqz.exe'
'%WINDIR%\icbbgl\rcrbe\uslji.exe' uid:101655 param:0
'%WINDIR%\uguqiui.exe' uid: param
'%WINDIR%\icbbgl\gmmxk\hprko.exe' uid:101655 param:0
'%WINDIR%\icbbgl\xplbd\bxggv.exe' uid:101655 param:0
'%WINDIR%\icbbgl\lzofr\hvmhc.exe' uid:101655 param:58js2496
'%WINDIR%\syswow64\cscript.exe' %WINDIR%\Combat.vbs
'%WINDIR%\syswow64\cmd.exe' /c del /Q /F "%WINDIR%\uguqiui.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\icbbgl\xplbd\bxggv.exe" >> NUL' (with hidden window)
'<SYSTEM32>\ipconfig.exe' /flushdns' (with hidden window)
'%WINDIR%\uguqiui.exe' uid: param:' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' %WINDIR%\Combat.vbs' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\icbbgl\rcrbe\uslji.exe" >> NUL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\icbbgl\ccpsqz.exe" >> NUL' (with hidden window)
'%WINDIR%\icbbgl\dbbkdd.exe' ' (with hidden window)
'%WINDIR%\syswow64\wscript.exe' "%WINDIR%\icbbgl\clean.vbs"' (with hidden window)
'%WINDIR%\syswow64\ipconfig.exe' /flushdns' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "<Full path to file>" >> NUL' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' %WINDIR%\AppCom32.dll /tlb:%WINDIR%\AppCom32.tlb /codebase' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "<Full path to file>" >> NUL
'<SYSTEM32>\taskhost.exe'
'%WINDIR%\syswow64\cmd.exe' /c del /Q /F "%WINDIR%\uguqiui.exe"
'%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\icbbgl\rcrbe\uslji.exe"
'<SYSTEM32>\gpupdate.exe'
'%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\icbbgl\ccpsqz.exe"
'<SYSTEM32>\wbem\wmiprvse.exe'
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\icbbgl\rcrbe\uslji.exe" >> NUL
'<SYSTEM32>\ipconfig.exe' /flushdns
'<SYSTEM32>\ndadmin.exe'
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\icbbgl\ccpsqz.exe" >> NUL
'%WINDIR%\syswow64\ipconfig.exe' /flushdns
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\icbbgl\xplbd\bxggv.exe" >> NUL
'%WINDIR%\syswow64\svchost.exe'
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\icbbgl\dbbkdd.exe"
'%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"
'%WINDIR%\syswow64\ping.exe' 127.0.0.1
'%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\icbbgl\xplbd\bxggv.exe"
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' %WINDIR%\AppCom32.dll /tlb:%WINDIR%\AppCom32.tlb /codebase

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial