Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program="<Full path to file>"
Modifies file system
Creates the following files
- %WINDIR%\scripttemp.ini
- %WINDIR%\_tempheukms1223162953123\pic\3-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\4-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\4-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\5-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\5-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\6-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\6-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\7-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\7-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\8-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\8-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\9-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\close.png
- %WINDIR%\_tempheukms1223162953123\pic\about-close1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\about-close2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\about-close3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\about1.jpg
- %WINDIR%\_tempheukms1223162953123\pic\about2.jpg
- %WINDIR%\_tempheukms1223162953123\pic\about3.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back1.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back2.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back3.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back4.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back5.jpg
- %WINDIR%\_tempheukms1223162953123\pic\3-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\9-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\3-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\14-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\10-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\10-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\10-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\11-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\11-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\12-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\12-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\13-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\13-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\13-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\14-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\15-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\20-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\15-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\16-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\16-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\17-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\17-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\18-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\18-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\19-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\2-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\2-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\2-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\20-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\color.png
- %WINDIR%\_tempheukms1223162953123\pic\down.png
- %WINDIR%\_tempheukms1223162953123\pic\logo.png
- %WINDIR%\_tempheukms1223162953123\pic0\ver.ico
- %WINDIR%\_tempheukms1223162953123\pic0\windows.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\zanzhu.ico
- %WINDIR%\_tempheukms1223162953123\setupcomplete.data
- %WINDIR%\_tempheukms1223162953123\svctrigger.xml
- %WINDIR%\_tempheukms1223162953123\kms-client.exe
- %WINDIR%\_tempheukms1223162953123\kms-server.exe
- %WINDIR%\_tempheukms1223162953123\kms.exe
- %WINDIR%\_tempheukms1223162953123\kms_x64.exe
- %WINDIR%\_tempheukms1223162953123\oem\bootrest.exe
- %WINDIR%\_tempheukms1223162953123\pic0\uninst-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\uninst.bmp
- %WINDIR%\_tempheukms1223162953123\oem\bootsect.exe
- %WINDIR%\_tempheukms1223162953123\oem\uefi.exe
- %WINDIR%\_tempheukms1223162953123\x64\cleanospp.exe
- %WINDIR%\_tempheukms1223162953123\x64\msvcr100.dll
- %WINDIR%\_tempheukms1223162953123\x64\secopatcher.dll
- %WINDIR%\_tempheukms1223162953123\x64\setacl.exe
- %WINDIR%\_tempheukms1223162953123\x64\sppextcomobjhook.dll
- %WINDIR%\_tempheukms1223162953123\x86\cleanospp.exe
- %WINDIR%\_tempheukms1223162953123\x86\msvcr100.dll
- %WINDIR%\_tempheukms1223162953123\x86\secopatcher.dll
- %WINDIR%\_tempheukms1223162953123\x86\setacl.exe
- %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet35.exe
- %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet40.exe
- %WINDIR%\_tempheukms1223162953123\pic0\uninst-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\shuoming.jpg
- %WINDIR%\_tempheukms1223162953123\pic0\restore.bmp
- %WINDIR%\_tempheukms1223162953123\pic\over.png
- %WINDIR%\_tempheukms1223162953123\pic\renewal.jpg
- %WINDIR%\_tempheukms1223162953123\pic\setting.png
- %WINDIR%\_tempheukms1223162953123\pic\skin.png
- %WINDIR%\_tempheukms1223162953123\pic\smart-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\smart-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\tab1.png
- %WINDIR%\_tempheukms1223162953123\pic\tab2.png
- %WINDIR%\_tempheukms1223162953123\pic\tab3.png
- %WINDIR%\_tempheukms1223162953123\pic\tab4.png
- %WINDIR%\_tempheukms1223162953123\pic\tab5.png
- %WINDIR%\_tempheukms1223162953123\pic\min.png
- %WINDIR%\_tempheukms1223162953123\pic0\backup-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\backup.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\ewm_wx.jpg
- %WINDIR%\_tempheukms1223162953123\pic0\ewm_zfb.jpg
- %WINDIR%\_tempheukms1223162953123\pic0\head.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\inst-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\inst-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\inst.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\left.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\office.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\restore-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\restore-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\backup-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic\1-2.bmp
- %WINDIR%\_tempheukms1223162953123\x86\sppextcomobjhook.dll
- %WINDIR%\_tempheukms1223162953123\pic\1-1.bmp
- %WINDIR%\_tempheukms1223162953123\otherofficeospp\ospp.vbs
- %WINDIR%\_tempheukms1223162953123\oem\cert\czc011.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\datate.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\dealin.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\dell.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\dsgltd.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\equus.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\exc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\exo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\foundr.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\fsc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\fuj.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\gensys.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\jetway.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\haier.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hasee.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hclinf.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hedy06.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\higrad.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hpqoem.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hspw07.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hyrslp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\ibm.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\itinfo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\creaas.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\gbt.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\cmscom.xrm-ms
- %WINDIR%\_tempheukms1223162953123\7z.exe
- %TEMP%\aut3fbe.tmp
- %WINDIR%\splashlogo.jpg
- %TEMP%\aut5561.tmp
- %WINDIR%\_tempheukms1223162953123\kmsmini.7z
- %TEMP%\aut5736.tmp
- %WINDIR%\_tempheukms1223162953123\digital.7z
- %TEMP%\aut57e2.tmp
- %WINDIR%\_tempheukms1223162953123\cert.7z
- %TEMP%\aut587f.tmp
- %WINDIR%\_tempheukms1223162953123\digitallicence.7z
- %TEMP%\aut591c.tmp
- %WINDIR%\heukmsrenewal\heu_kms_activator.exe
- %WINDIR%\_tempheukms1223162953123\oem\cert\ccelnf.xrm-ms
- %WINDIR%\_tempheukms1223162953123\heu_configuration.ini
- %WINDIR%\_tempheukms1223162953123\heu_kms_renewal.xml
- %WINDIR%\_tempheukms1223162953123\heu_set.ini
- %WINDIR%\_tempheukms1223162953123\oem\cert\acrsys.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\alware.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\aquari.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\atcomp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\bekopc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\benq.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\bgh.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\casper.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\cgwall.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\jooyon.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\k.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\krftwy.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosasu.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosbyd.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\toscpl.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\toshib.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosinv.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosqci.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\trigem.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\vestel.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\vscaio.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\wortma.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\thoa21.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\thtfpc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\xplore.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\emulateslic
- %WINDIR%\_tempheukms1223162953123\oem\emulateslic.bin
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr1
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr2
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr34
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr5
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr6
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr7
- %WINDIR%\_tempheukms1223162953123\office2010ospp\ospp.vbs
- %WINDIR%\_tempheukms1223162953123\office2010ospp\slerror.xml
- %WINDIR%\_tempheukms1223162953123\oem\cert\yutc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\_asus_.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tarox1.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\sysmax.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\synnex.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\lenovo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\lge.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\login2.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\matbio.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\matech.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\medion.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\mitac.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\msi_nb.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\navihb.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\nec.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\nokia.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\lanix1.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\oegrou.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\olislp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\onkyo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\philco.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\positi.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\prdgt.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\qbexco.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\quanmx.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\rm.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\seccsd.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\sony.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\stinfo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\olipro.xrm-ms
- %WINDIR%\_tempheukms1223162953123\otherofficeospp\slerror.xml
- %WINDIR%\_tempheukms1223162953123\scriptdir.ini
Sets the 'hidden' attribute to the following files
- %WINDIR%\_tempheukms1223162953123\heu_kms_renewal.xml
- %WINDIR%\_tempheukms1223162953123\pic\9-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\9-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\about-close1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\about-close2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\about-close3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\about1.jpg
- %WINDIR%\_tempheukms1223162953123\pic\about2.jpg
- %WINDIR%\_tempheukms1223162953123\pic\about3.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back1.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back2.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back3.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back4.jpg
- %WINDIR%\_tempheukms1223162953123\pic\back5.jpg
- %WINDIR%\_tempheukms1223162953123\pic\close.png
- %WINDIR%\_tempheukms1223162953123\pic\color.png
- %WINDIR%\_tempheukms1223162953123\pic\down.png
- %WINDIR%\_tempheukms1223162953123\pic\logo.png
- %WINDIR%\_tempheukms1223162953123\pic\min.png
- %WINDIR%\_tempheukms1223162953123\pic\over.png
- %WINDIR%\_tempheukms1223162953123\pic\renewal.jpg
- %WINDIR%\_tempheukms1223162953123\pic\setting.png
- %WINDIR%\_tempheukms1223162953123\pic\skin.png
- %WINDIR%\_tempheukms1223162953123\pic\smart-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\8-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\14-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\8-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\7-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\15-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\15-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\16-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\16-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\17-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\17-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\18-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\18-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\19-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\2-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\2-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\2-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\20-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\20-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\3-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\3-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\3-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\4-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\4-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\5-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\5-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\6-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\6-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\7-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\14-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\smart-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\tab4.png
- %WINDIR%\_tempheukms1223162953123\kms.exe
- %WINDIR%\_tempheukms1223162953123\kms_x64.exe
- %WINDIR%\_tempheukms1223162953123\oem\bootrest.exe
- %WINDIR%\_tempheukms1223162953123\oem\bootsect.exe
- %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet35.exe
- %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet40.exe
- %WINDIR%\_tempheukms1223162953123\oem\uefi.exe
- %WINDIR%\_tempheukms1223162953123\x64\cleanospp.exe
- %WINDIR%\_tempheukms1223162953123\x64\msvcr100.dll
- %WINDIR%\_tempheukms1223162953123\x64\secopatcher.dll
- %WINDIR%\_tempheukms1223162953123\oem\cert\synnex.xrm-ms
- %WINDIR%\_tempheukms1223162953123\x64\setacl.exe
- %WINDIR%\_tempheukms1223162953123\x86\cleanospp.exe
- %WINDIR%\_tempheukms1223162953123\x86\msvcr100.dll
- %WINDIR%\_tempheukms1223162953123\x86\secopatcher.dll
- %WINDIR%\_tempheukms1223162953123\x86\setacl.exe
- %WINDIR%\_tempheukms1223162953123\x86\sppextcomobjhook.dll
- %WINDIR%\_tempheukms1223162953123\7z.exe
- %WINDIR%\_tempheukms1223162953123\cert.7z
- %WINDIR%\_tempheukms1223162953123\digital.7z
- %WINDIR%\_tempheukms1223162953123\digitallicence.7z
- %WINDIR%\_tempheukms1223162953123\heu_configuration.ini
- %WINDIR%\_tempheukms1223162953123\kms-client.exe
- %WINDIR%\_tempheukms1223162953123\kms-server.exe
- %WINDIR%\_tempheukms1223162953123\pic\tab2.png
- %WINDIR%\_tempheukms1223162953123\pic\tab1.png
- %WINDIR%\_tempheukms1223162953123\pic0\zanzhu.ico
- %WINDIR%\_tempheukms1223162953123\pic\tab5.png
- %WINDIR%\_tempheukms1223162953123\pic0\backup-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\backup-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\backup.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\ewm_wx.jpg
- %WINDIR%\_tempheukms1223162953123\pic0\ewm_zfb.jpg
- %WINDIR%\_tempheukms1223162953123\pic0\head.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\inst-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\inst-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\inst.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\left.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\office.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\restore-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\restore-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\restore.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\shuoming.jpg
- %WINDIR%\_tempheukms1223162953123\pic0\uninst-en.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\uninst-tra.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\uninst.bmp
- %WINDIR%\_tempheukms1223162953123\pic0\ver.ico
- %WINDIR%\_tempheukms1223162953123\pic0\windows.bmp
- %WINDIR%\_tempheukms1223162953123\setupcomplete.data
- %WINDIR%\_tempheukms1223162953123\pic\tab3.png
- %WINDIR%\_tempheukms1223162953123\svctrigger.xml
- %WINDIR%\_tempheukms1223162953123\pic\13-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\13-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\13-1.bmp
- %WINDIR%\_tempheukms1223162953123\oem\cert\hclinf.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hedy06.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\higrad.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hpqoem.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hspw07.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hyrslp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\ibm.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\itinfo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\jetway.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\jooyon.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\k.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\krftwy.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\lanix1.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\lenovo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\lge.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\login2.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\matbio.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\matech.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\medion.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\mitac.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\msi_nb.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\haier.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\navihb.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\gensys.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\fuj.xrm-ms
- %WINDIR%\_tempheukms1223162953123\heu_set.ini
- %WINDIR%\_tempheukms1223162953123\oem\cert\acrsys.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\alware.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\aquari.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\atcomp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\bekopc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\benq.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\bgh.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\casper.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\ccelnf.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\cgwall.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\cmscom.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\creaas.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\czc011.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\datate.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\dealin.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\dell.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\dsgltd.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\equus.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\exc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\exo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\foundr.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\fsc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\gbt.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\nec.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\hasee.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\nokia.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\yutc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\emulateslic
- %WINDIR%\_tempheukms1223162953123\oem\emulateslic.bin
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr1
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr2
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr34
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr5
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr6
- %WINDIR%\_tempheukms1223162953123\oem\gr1dr7
- %WINDIR%\_tempheukms1223162953123\office2010ospp\ospp.vbs
- %WINDIR%\_tempheukms1223162953123\office2010ospp\slerror.xml
- %WINDIR%\_tempheukms1223162953123\otherofficeospp\ospp.vbs
- %WINDIR%\_tempheukms1223162953123\otherofficeospp\slerror.xml
- %WINDIR%\_tempheukms1223162953123\pic\1-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\1-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\10-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\10-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\10-3.bmp
- %WINDIR%\_tempheukms1223162953123\pic\11-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\11-2.bmp
- %WINDIR%\_tempheukms1223162953123\pic\12-1.bmp
- %WINDIR%\_tempheukms1223162953123\pic\12-2.bmp
- %WINDIR%\_tempheukms1223162953123\oem\cert\xplore.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\vscaio.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\_asus_.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\wortma.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\vestel.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\oegrou.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\olislp.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\onkyo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\philco.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\positi.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\prdgt.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\qbexco.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\quanmx.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\rm.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\seccsd.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\sony.xrm-ms
- %WINDIR%\_tempheukms1223162953123\kmsmini.7z
- %WINDIR%\_tempheukms1223162953123\x64\sppextcomobjhook.dll
- %WINDIR%\_tempheukms1223162953123\oem\cert\stinfo.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tarox1.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\thoa21.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\thtfpc.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosasu.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosbyd.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\toscpl.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\toshib.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosinv.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\tosqci.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\trigem.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\olipro.xrm-ms
- %WINDIR%\_tempheukms1223162953123\oem\cert\sysmax.xrm-ms
- %WINDIR%\_tempheukms1223162953123\scriptdir.ini
Deletes the following files
- %TEMP%\aut3fbe.tmp
- %TEMP%\aut5561.tmp
- %TEMP%\aut5736.tmp
- %TEMP%\aut57e2.tmp
- %TEMP%\aut587f.tmp
- %TEMP%\aut591c.tmp
Network activity
UDP
- DNS ASK ba##u.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\_tempheukms1223162953123\7z.exe' x %WINDIR%\_tempheukms1223162953123\KMSmini.7z -y -o%WINDIR%\_tempheukms1223162953123
- '%WINDIR%\_tempheukms1223162953123\kms_x64.exe'
- '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_tempheukms1223162953123 >>%windir%\ScriptTemp.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...' (with hidden window)
- '%WINDIR%\_tempheukms1223162953123\7z.exe' x %WINDIR%\_tempheukms1223162953123\KMSmini.7z -y -o%WINDIR%\_tempheukms1223162953123' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_tempheukms1223162953123\ScriptDir.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_tempheukms1223162953123\ScriptDir.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_tempheukms1223162953123\ScriptDir.ini' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini
- '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_tempheukms1223162953123 >>%windir%\ScriptTemp.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="HEU_KMS_Activator"
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_tempheukms1223162953123\ScriptDir.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_tempheukms1223162953123\ScriptDir.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_tempheukms1223162953123\ScriptDir.ini
