FOR CUSTOMERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.MulDrop15.64932

Added to the Dr.Web virus database: 2020-12-23

Virus description added:

Technical Information

Malicious functions
Executes the following
  • '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program="<Full path to file>"
Modifies file system
Creates the following files
  • %WINDIR%\scripttemp.ini
  • %WINDIR%\_tempheukms1223162953123\pic\3-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\4-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\4-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\5-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\5-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\6-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\6-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\7-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\7-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\8-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\8-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\9-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\close.png
  • %WINDIR%\_tempheukms1223162953123\pic\about-close1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\about-close2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\about-close3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\about1.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\about2.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\about3.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back1.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back2.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back3.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back4.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back5.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\3-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\9-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\3-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\14-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\10-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\10-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\10-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\11-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\11-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\12-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\12-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\13-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\13-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\13-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\14-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\15-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\20-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\15-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\16-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\16-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\17-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\17-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\18-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\18-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\19-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\2-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\2-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\2-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\20-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\color.png
  • %WINDIR%\_tempheukms1223162953123\pic\down.png
  • %WINDIR%\_tempheukms1223162953123\pic\logo.png
  • %WINDIR%\_tempheukms1223162953123\pic0\ver.ico
  • %WINDIR%\_tempheukms1223162953123\pic0\windows.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\zanzhu.ico
  • %WINDIR%\_tempheukms1223162953123\setupcomplete.data
  • %WINDIR%\_tempheukms1223162953123\svctrigger.xml
  • %WINDIR%\_tempheukms1223162953123\kms-client.exe
  • %WINDIR%\_tempheukms1223162953123\kms-server.exe
  • %WINDIR%\_tempheukms1223162953123\kms.exe
  • %WINDIR%\_tempheukms1223162953123\kms_x64.exe
  • %WINDIR%\_tempheukms1223162953123\oem\bootrest.exe
  • %WINDIR%\_tempheukms1223162953123\pic0\uninst-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\uninst.bmp
  • %WINDIR%\_tempheukms1223162953123\oem\bootsect.exe
  • %WINDIR%\_tempheukms1223162953123\oem\uefi.exe
  • %WINDIR%\_tempheukms1223162953123\x64\cleanospp.exe
  • %WINDIR%\_tempheukms1223162953123\x64\msvcr100.dll
  • %WINDIR%\_tempheukms1223162953123\x64\secopatcher.dll
  • %WINDIR%\_tempheukms1223162953123\x64\setacl.exe
  • %WINDIR%\_tempheukms1223162953123\x64\sppextcomobjhook.dll
  • %WINDIR%\_tempheukms1223162953123\x86\cleanospp.exe
  • %WINDIR%\_tempheukms1223162953123\x86\msvcr100.dll
  • %WINDIR%\_tempheukms1223162953123\x86\secopatcher.dll
  • %WINDIR%\_tempheukms1223162953123\x86\setacl.exe
  • %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet35.exe
  • %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet40.exe
  • %WINDIR%\_tempheukms1223162953123\pic0\uninst-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\shuoming.jpg
  • %WINDIR%\_tempheukms1223162953123\pic0\restore.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\over.png
  • %WINDIR%\_tempheukms1223162953123\pic\renewal.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\setting.png
  • %WINDIR%\_tempheukms1223162953123\pic\skin.png
  • %WINDIR%\_tempheukms1223162953123\pic\smart-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\smart-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\tab1.png
  • %WINDIR%\_tempheukms1223162953123\pic\tab2.png
  • %WINDIR%\_tempheukms1223162953123\pic\tab3.png
  • %WINDIR%\_tempheukms1223162953123\pic\tab4.png
  • %WINDIR%\_tempheukms1223162953123\pic\tab5.png
  • %WINDIR%\_tempheukms1223162953123\pic\min.png
  • %WINDIR%\_tempheukms1223162953123\pic0\backup-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\backup.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\ewm_wx.jpg
  • %WINDIR%\_tempheukms1223162953123\pic0\ewm_zfb.jpg
  • %WINDIR%\_tempheukms1223162953123\pic0\head.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\inst-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\inst-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\inst.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\left.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\office.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\restore-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\restore-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\backup-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\1-2.bmp
  • %WINDIR%\_tempheukms1223162953123\x86\sppextcomobjhook.dll
  • %WINDIR%\_tempheukms1223162953123\pic\1-1.bmp
  • %WINDIR%\_tempheukms1223162953123\otherofficeospp\ospp.vbs
  • %WINDIR%\_tempheukms1223162953123\oem\cert\czc011.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\datate.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\dealin.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\dell.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\dsgltd.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\equus.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\exc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\exo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\foundr.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\fsc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\fuj.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\gensys.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\jetway.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\haier.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hasee.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hclinf.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hedy06.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\higrad.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hpqoem.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hspw07.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hyrslp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\ibm.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\itinfo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\creaas.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\gbt.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\cmscom.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\7z.exe
  • %TEMP%\aut3fbe.tmp
  • %WINDIR%\splashlogo.jpg
  • %TEMP%\aut5561.tmp
  • %WINDIR%\_tempheukms1223162953123\kmsmini.7z
  • %TEMP%\aut5736.tmp
  • %WINDIR%\_tempheukms1223162953123\digital.7z
  • %TEMP%\aut57e2.tmp
  • %WINDIR%\_tempheukms1223162953123\cert.7z
  • %TEMP%\aut587f.tmp
  • %WINDIR%\_tempheukms1223162953123\digitallicence.7z
  • %TEMP%\aut591c.tmp
  • %WINDIR%\heukmsrenewal\heu_kms_activator.exe
  • %WINDIR%\_tempheukms1223162953123\oem\cert\ccelnf.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\heu_configuration.ini
  • %WINDIR%\_tempheukms1223162953123\heu_kms_renewal.xml
  • %WINDIR%\_tempheukms1223162953123\heu_set.ini
  • %WINDIR%\_tempheukms1223162953123\oem\cert\acrsys.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\alware.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\aquari.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\atcomp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\bekopc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\benq.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\bgh.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\casper.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\cgwall.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\jooyon.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\k.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\krftwy.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosasu.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosbyd.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\toscpl.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\toshib.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosinv.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosqci.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\trigem.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\vestel.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\vscaio.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\wortma.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\thoa21.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\thtfpc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\xplore.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\emulateslic
  • %WINDIR%\_tempheukms1223162953123\oem\emulateslic.bin
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr1
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr2
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr34
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr5
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr6
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr7
  • %WINDIR%\_tempheukms1223162953123\office2010ospp\ospp.vbs
  • %WINDIR%\_tempheukms1223162953123\office2010ospp\slerror.xml
  • %WINDIR%\_tempheukms1223162953123\oem\cert\yutc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\_asus_.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tarox1.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\sysmax.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\synnex.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\lenovo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\lge.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\login2.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\matbio.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\matech.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\medion.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\mitac.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\msi_nb.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\navihb.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\nec.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\nokia.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\lanix1.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\oegrou.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\olislp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\onkyo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\philco.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\positi.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\prdgt.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\qbexco.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\quanmx.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\rm.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\seccsd.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\sony.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\stinfo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\olipro.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\otherofficeospp\slerror.xml
  • %WINDIR%\_tempheukms1223162953123\scriptdir.ini
Sets the 'hidden' attribute to the following files
  • %WINDIR%\_tempheukms1223162953123\heu_kms_renewal.xml
  • %WINDIR%\_tempheukms1223162953123\pic\9-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\9-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\about-close1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\about-close2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\about-close3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\about1.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\about2.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\about3.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back1.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back2.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back3.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back4.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\back5.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\close.png
  • %WINDIR%\_tempheukms1223162953123\pic\color.png
  • %WINDIR%\_tempheukms1223162953123\pic\down.png
  • %WINDIR%\_tempheukms1223162953123\pic\logo.png
  • %WINDIR%\_tempheukms1223162953123\pic\min.png
  • %WINDIR%\_tempheukms1223162953123\pic\over.png
  • %WINDIR%\_tempheukms1223162953123\pic\renewal.jpg
  • %WINDIR%\_tempheukms1223162953123\pic\setting.png
  • %WINDIR%\_tempheukms1223162953123\pic\skin.png
  • %WINDIR%\_tempheukms1223162953123\pic\smart-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\8-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\14-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\8-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\7-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\15-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\15-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\16-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\16-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\17-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\17-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\18-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\18-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\19-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\2-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\2-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\2-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\20-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\20-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\3-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\3-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\3-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\4-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\4-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\5-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\5-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\6-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\6-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\7-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\14-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\smart-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\tab4.png
  • %WINDIR%\_tempheukms1223162953123\kms.exe
  • %WINDIR%\_tempheukms1223162953123\kms_x64.exe
  • %WINDIR%\_tempheukms1223162953123\oem\bootrest.exe
  • %WINDIR%\_tempheukms1223162953123\oem\bootsect.exe
  • %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet35.exe
  • %WINDIR%\_tempheukms1223162953123\oem\oemdumpnet40.exe
  • %WINDIR%\_tempheukms1223162953123\oem\uefi.exe
  • %WINDIR%\_tempheukms1223162953123\x64\cleanospp.exe
  • %WINDIR%\_tempheukms1223162953123\x64\msvcr100.dll
  • %WINDIR%\_tempheukms1223162953123\x64\secopatcher.dll
  • %WINDIR%\_tempheukms1223162953123\oem\cert\synnex.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\x64\setacl.exe
  • %WINDIR%\_tempheukms1223162953123\x86\cleanospp.exe
  • %WINDIR%\_tempheukms1223162953123\x86\msvcr100.dll
  • %WINDIR%\_tempheukms1223162953123\x86\secopatcher.dll
  • %WINDIR%\_tempheukms1223162953123\x86\setacl.exe
  • %WINDIR%\_tempheukms1223162953123\x86\sppextcomobjhook.dll
  • %WINDIR%\_tempheukms1223162953123\7z.exe
  • %WINDIR%\_tempheukms1223162953123\cert.7z
  • %WINDIR%\_tempheukms1223162953123\digital.7z
  • %WINDIR%\_tempheukms1223162953123\digitallicence.7z
  • %WINDIR%\_tempheukms1223162953123\heu_configuration.ini
  • %WINDIR%\_tempheukms1223162953123\kms-client.exe
  • %WINDIR%\_tempheukms1223162953123\kms-server.exe
  • %WINDIR%\_tempheukms1223162953123\pic\tab2.png
  • %WINDIR%\_tempheukms1223162953123\pic\tab1.png
  • %WINDIR%\_tempheukms1223162953123\pic0\zanzhu.ico
  • %WINDIR%\_tempheukms1223162953123\pic\tab5.png
  • %WINDIR%\_tempheukms1223162953123\pic0\backup-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\backup-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\backup.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\ewm_wx.jpg
  • %WINDIR%\_tempheukms1223162953123\pic0\ewm_zfb.jpg
  • %WINDIR%\_tempheukms1223162953123\pic0\head.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\inst-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\inst-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\inst.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\left.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\office.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\restore-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\restore-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\restore.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\shuoming.jpg
  • %WINDIR%\_tempheukms1223162953123\pic0\uninst-en.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\uninst-tra.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\uninst.bmp
  • %WINDIR%\_tempheukms1223162953123\pic0\ver.ico
  • %WINDIR%\_tempheukms1223162953123\pic0\windows.bmp
  • %WINDIR%\_tempheukms1223162953123\setupcomplete.data
  • %WINDIR%\_tempheukms1223162953123\pic\tab3.png
  • %WINDIR%\_tempheukms1223162953123\svctrigger.xml
  • %WINDIR%\_tempheukms1223162953123\pic\13-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\13-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\13-1.bmp
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hclinf.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hedy06.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\higrad.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hpqoem.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hspw07.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hyrslp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\ibm.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\itinfo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\jetway.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\jooyon.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\k.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\krftwy.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\lanix1.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\lenovo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\lge.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\login2.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\matbio.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\matech.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\medion.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\mitac.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\msi_nb.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\haier.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\navihb.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\gensys.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\fuj.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\heu_set.ini
  • %WINDIR%\_tempheukms1223162953123\oem\cert\acrsys.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\alware.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\aquari.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\atcomp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\bekopc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\benq.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\bgh.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\casper.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\ccelnf.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\cgwall.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\cmscom.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\creaas.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\czc011.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\datate.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\dealin.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\dell.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\dsgltd.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\equus.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\exc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\exo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\foundr.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\fsc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\gbt.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\nec.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\hasee.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\nokia.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\yutc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\emulateslic
  • %WINDIR%\_tempheukms1223162953123\oem\emulateslic.bin
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr1
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr2
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr34
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr5
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr6
  • %WINDIR%\_tempheukms1223162953123\oem\gr1dr7
  • %WINDIR%\_tempheukms1223162953123\office2010ospp\ospp.vbs
  • %WINDIR%\_tempheukms1223162953123\office2010ospp\slerror.xml
  • %WINDIR%\_tempheukms1223162953123\otherofficeospp\ospp.vbs
  • %WINDIR%\_tempheukms1223162953123\otherofficeospp\slerror.xml
  • %WINDIR%\_tempheukms1223162953123\pic\1-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\1-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\10-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\10-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\10-3.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\11-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\11-2.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\12-1.bmp
  • %WINDIR%\_tempheukms1223162953123\pic\12-2.bmp
  • %WINDIR%\_tempheukms1223162953123\oem\cert\xplore.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\vscaio.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\_asus_.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\wortma.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\vestel.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\oegrou.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\olislp.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\onkyo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\philco.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\positi.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\prdgt.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\qbexco.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\quanmx.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\rm.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\seccsd.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\sony.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\kmsmini.7z
  • %WINDIR%\_tempheukms1223162953123\x64\sppextcomobjhook.dll
  • %WINDIR%\_tempheukms1223162953123\oem\cert\stinfo.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tarox1.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\thoa21.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\thtfpc.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosasu.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosbyd.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\toscpl.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\toshib.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosinv.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\tosqci.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\trigem.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\olipro.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\oem\cert\sysmax.xrm-ms
  • %WINDIR%\_tempheukms1223162953123\scriptdir.ini
Deletes the following files
  • %TEMP%\aut3fbe.tmp
  • %TEMP%\aut5561.tmp
  • %TEMP%\aut5736.tmp
  • %TEMP%\aut57e2.tmp
  • %TEMP%\aut587f.tmp
  • %TEMP%\aut591c.tmp
Network activity
UDP
  • DNS ASK ba##u.com
Miscellaneous
Creates and executes the following
  • '%WINDIR%\_tempheukms1223162953123\7z.exe' x %WINDIR%\_tempheukms1223162953123\KMSmini.7z -y -o%WINDIR%\_tempheukms1223162953123
  • '%WINDIR%\_tempheukms1223162953123\kms_x64.exe'
  • '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_tempheukms1223162953123 >>%windir%\ScriptTemp.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...' (with hidden window)
  • '%WINDIR%\_tempheukms1223162953123\7z.exe' x %WINDIR%\_tempheukms1223162953123\KMSmini.7z -y -o%WINDIR%\_tempheukms1223162953123' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_tempheukms1223162953123\ScriptDir.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_tempheukms1223162953123\ScriptDir.ini' (with hidden window)
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_tempheukms1223162953123\ScriptDir.ini' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini
  • '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_tempheukms1223162953123 >>%windir%\ScriptTemp.ini
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"
  • '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="HEU_KMS_Activator"
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_tempheukms1223162953123\ScriptDir.ini
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_tempheukms1223162953123\ScriptDir.ini
  • '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_tempheukms1223162953123\ScriptDir.ini

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

© Doctor Web
2003 — 2022

Doctor Web is a cybersecurity company focused on threat detection, prevention and response technologies