Trojan.Siggen18.56066

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'FR32GRfvap5' = '"%APPDATA%\Oracle\bin\javaw.exe" -jar "%HOMEPATH%\FCNJIG8Pbdh\3vXAV2MonQb.TqdTo2"'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAService.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSSVC.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EMLPROXY.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QUHLPSVC.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAPISSVC.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANNER.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANWSCS.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scproxysrv.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScSecSvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERAntiSpyware.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NS.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprosec.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7AVScan.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7SysMon.Exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMain.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMngr.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanosvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCore64.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnf.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nfservice.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwscmon.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\njeeves2.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcod.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nbrowser.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIPREUI.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient_Diagnostic_Tool.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASTask.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWelcome.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utsvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSUpdate64.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCHelper64.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmon.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiESNAC.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiProxy.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiSSLVPNdaemon.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiFW.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldDS.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCS-Uninstall.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldRTM.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldCCC.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavUpdater.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWatchDog.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiSeAgnt.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtWatchDog.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSvcHost.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreFrameworkHost.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreServiceShell.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERDelete.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiUpdateTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBPIMSvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bavhm.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bav.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavWebClient.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCDBlog.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7PSSrvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDKBFltExe32.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebCompanion.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Main.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Svc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Up.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Proxy.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Medic.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuarScanner.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LittleHook.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamscan.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BgScan.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYSSER.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKProxy.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDScan.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKService.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cis.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusutilities.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff_x64.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclamwrap.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FProtTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWin.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trigger.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSM32.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fssm32.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dragon_updater.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CONSCTLX.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7FWSrvc.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanpro.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIEWTCP.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSHDLL64.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fshoster32.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSMA32.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsorsp.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOS.EXE] 'debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av_task.exe] 'debugger' = 'svchost.exe'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

blocks the following features:

System Restore (SR)
User Account Control (UAC)

Executes the following

'<SYSTEM32>\taskkill.exe' /IM UserAccountControlSettings.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM trigger.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM FSM32.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM fssm32.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM fsorsp.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM FSMA32.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM fshoster32.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM fsgk32.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM FSHDLL64.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM FProtTray.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM VIEWTCP.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM TRAYICOS.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM TRAYSSER.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM escanpro.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM escanmon.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM econceal.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM avpmapp.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM CONSCTLX.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM MWASER.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM econser.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM FPWin.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM FPAVServer.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AVK.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM K7TSecurity.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM K7EmlPxy.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM K7PSSrvc.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM K7FWSrvc.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM K7RTScan.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM freshclamwrap.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM freshclam.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM iptray.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM guardxkickoff_x64.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM guardxservice.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM virusutilities.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM GDSC.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM GDKBFltExe32.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AVKTray.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AVKService.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AVKWCtlx64.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM GDScan.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AVKProxy.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM GdBgInx64.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM MWAGENT.EXE /T /F
'<SYSTEM32>\taskkill.exe' /IM K7AVScan.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM dragon_updater.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM cmdagent.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM mbam.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM capinfos.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM dumpcap.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM editcap.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM mergecap.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM rawshark.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM text2pcap.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM tshark.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM mbamscheduler.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM wireshark.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM NisSrv.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM MpCmdRun.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM MpUXSrv.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM MsMpEng.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM MSASCui.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM procexp.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM ProcessHacker.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM Taskmgr.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM ConfigSecurityPolicy.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM mbamservice.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AdAwareService.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AdAwareTray.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM CisTray.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM cis.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM ClamWin.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM ClamTray.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM clamscan.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM BullGuardUpdate.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM LittleHook.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM BullGuarScanner.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM BullGuardBhvScanner.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM BullGuard.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM BgScan.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM V3Medic.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM V3Proxy.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM V3SP.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM V3Up.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM V3Svc.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM V3Main.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM AdAwareDesktop.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM WebCompanion.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM cavwp.exe /T /F
'<SYSTEM32>\taskkill.exe' /IM K7CrvSvc.exe /T /F

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\xcopy.exe

Modifies file system

Creates the following files

%APPDATA%\oracle\copyright
%APPDATA%\oracle\lib\tzmappings
%APPDATA%\oracle\lib\amd64\jvm.cfg
%APPDATA%\oracle\lib\cmm\ciexyz.pf
%APPDATA%\oracle\lib\cmm\gray.pf
%APPDATA%\oracle\lib\cmm\linear_rgb.pf
%APPDATA%\oracle\lib\cmm\pycc.pf
%APPDATA%\oracle\lib\cmm\srgb.pf
%APPDATA%\oracle\lib\rt.jar
%APPDATA%\oracle\lib\deploy\ffjcext.zip
%APPDATA%\oracle\lib\tzdb.dat
%APPDATA%\oracle\lib\deploy\messages_de.properties
%APPDATA%\oracle\lib\deploy\messages_fr.properties
%APPDATA%\oracle\lib\deploy\messages_it.properties
%APPDATA%\oracle\lib\deploy\messages_ja.properties
%APPDATA%\oracle\lib\deploy\messages_ko.properties
%APPDATA%\oracle\lib\deploy\messages_pt_br.properties
%APPDATA%\oracle\lib\deploy\messages_sv.properties
%APPDATA%\oracle\lib\deploy\messages_zh_cn.properties
%APPDATA%\oracle\lib\deploy\messages.properties
%APPDATA%\oracle\lib\deploy\messages_zh_hk.properties
%APPDATA%\oracle\lib\deploy\messages_es.properties
%APPDATA%\oracle\lib\sound.properties
%APPDATA%\oracle\lib\resources.jar
%APPDATA%\oracle\lib\psfontj2d.properties
%APPDATA%\oracle\lib\content-types.properties
%APPDATA%\oracle\lib\currency.data
%APPDATA%\oracle\lib\deploy.jar
%APPDATA%\oracle\lib\flavormap.properties
%APPDATA%\oracle\lib\fontconfig.bfc
%APPDATA%\oracle\lib\fontconfig.properties.src
%APPDATA%\oracle\lib\hijrah-config-umalqura.properties
%APPDATA%\oracle\lib\javafx.properties
%APPDATA%\oracle\lib\charsets.jar
%APPDATA%\oracle\lib\javaws.jar
%APPDATA%\oracle\lib\jfr.jar
%APPDATA%\oracle\lib\jfxswt.jar
%APPDATA%\oracle\lib\jsse.jar
%APPDATA%\oracle\lib\jvm.hprof.txt
%APPDATA%\oracle\lib\logging.properties
%APPDATA%\oracle\lib\management-agent.jar
%APPDATA%\oracle\lib\meta-index
%APPDATA%\oracle\lib\net.properties
%APPDATA%\oracle\lib\plugin.jar
%APPDATA%\oracle\lib\jce.jar
%APPDATA%\oracle\lib\psfont.properties.ja
%APPDATA%\oracle\lib\calendars.properties
%APPDATA%\oracle\lib\classlist
%APPDATA%\oracle\lib\deploy\messages_zh_tw.properties
%APPDATA%\oracle\lib\ext\cldrdata.jar
%APPDATA%\oracle\lib\images\cursors\win32_linknodrop32x32.gif
%APPDATA%\oracle\lib\images\cursors\win32_movedrop32x32.gif
%APPDATA%\oracle\lib\images\cursors\win32_movenodrop32x32.gif
%APPDATA%\oracle\lib\jfr\default.jfc
%APPDATA%\oracle\lib\jfr\profile.jfc
%APPDATA%\oracle\lib\management\jmxremote.access
%APPDATA%\oracle\lib\management\jmxremote.password.template
%APPDATA%\oracle\lib\management\management.properties
%APPDATA%\oracle\lib\images\cursors\win32_copynodrop32x32.gif
%APPDATA%\oracle\lib\images\cursors\win32_linkdrop32x32.gif
%APPDATA%\oracle\lib\management\snmp.acl.template
%APPDATA%\oracle\lib\security\cacerts
%APPDATA%\oracle\lib\security\java.policy
%APPDATA%\oracle\lib\security\java.security
%APPDATA%\oracle\lib\security\javaws.policy
%APPDATA%\oracle\lib\security\local_policy.jar
%APPDATA%\oracle\lib\security\us_export_policy.jar
%HOMEPATH%\fcnjig8pbdh\id.txt
%HOMEPATH%\fcnjig8pbdh\3vxav2monqb.tqdto2
%APPDATA%\oracle\lib\security\blacklist
%APPDATA%\oracle\lib\security\blacklisted.certs
%APPDATA%\oracle\lib\images\cursors\win32_copydrop32x32.gif
%APPDATA%\oracle\lib\images\cursors\cursors.properties
%APPDATA%\oracle\bin\prism_sw.dll
%APPDATA%\oracle\lib\ext\dnsns.jar
%APPDATA%\oracle\lib\ext\jaccess.jar
%APPDATA%\oracle\lib\ext\jfxrt.jar
%APPDATA%\oracle\lib\ext\localedata.jar
%APPDATA%\oracle\lib\ext\meta-index
%APPDATA%\oracle\lib\ext\nashorn.jar
%APPDATA%\oracle\lib\ext\sunec.jar
%APPDATA%\oracle\lib\ext\sunjce_provider.jar
%APPDATA%\oracle\lib\ext\sunmscapi.jar
%APPDATA%\oracle\lib\ext\sunpkcs11.jar
%APPDATA%\oracle\lib\ext\zipfs.jar
%APPDATA%\oracle\lib\fonts\lucidabrightdemibold.ttf
%APPDATA%\oracle\lib\fonts\lucidabrightdemiitalic.ttf
%APPDATA%\oracle\lib\fonts\lucidabrightitalic.ttf
%APPDATA%\oracle\lib\fonts\lucidabrightregular.ttf
%APPDATA%\oracle\lib\fonts\lucidasansdemibold.ttf
%APPDATA%\oracle\lib\fonts\lucidasansregular.ttf
%APPDATA%\oracle\lib\fonts\lucidatypewriterbold.ttf
%APPDATA%\oracle\lib\fonts\lucidatypewriterregular.ttf
%APPDATA%\oracle\lib\deploy\splash.gif
%APPDATA%\oracle\lib\ext\access-bridge-64.jar
%APPDATA%\oracle\lib\deploy\splash@2x.gif
%APPDATA%\oracle\lib\accessibility.properties
%APPDATA%\oracle\bin\server\xusage.txt
%APPDATA%\oracle\bin\server\jvm.dll
%APPDATA%\oracle\bin\java.exe
%APPDATA%\oracle\bin\javaaccessbridge-64.dll
%APPDATA%\oracle\bin\javacpl.cpl
%APPDATA%\oracle\bin\javacpl.exe
%APPDATA%\oracle\bin\javafx_font.dll
%APPDATA%\oracle\bin\javafx_font_t2k.dll
%APPDATA%\oracle\bin\javafx_iio.dll
%APPDATA%\oracle\bin\jabswitch.exe
%APPDATA%\oracle\bin\javaw.exe
%APPDATA%\oracle\bin\java.dll
%APPDATA%\oracle\bin\java_crw_demo.dll
%APPDATA%\oracle\bin\jawtaccessbridge-64.dll
%APPDATA%\oracle\bin\jdwp.dll
%APPDATA%\oracle\bin\jfr.dll
%APPDATA%\oracle\bin\jfxmedia.dll
%APPDATA%\oracle\bin\jfxwebkit.dll
%APPDATA%\oracle\bin\jjs.exe
%APPDATA%\oracle\bin\jli.dll
%APPDATA%\oracle\bin\javaws.exe
%APPDATA%\oracle\bin\jaas_nt.dll
%APPDATA%\oracle\bin\jawt.dll
%APPDATA%\oracle\bin\j2pkcs11.dll
%APPDATA%\oracle\bin\j2pcsc.dll
%APPDATA%\oracle\license
%APPDATA%\oracle\release
%APPDATA%\oracle\thirdpartylicensereadme-javafx.txt
%APPDATA%\oracle\thirdpartylicensereadme.txt
%APPDATA%\oracle\welcome.html
%APPDATA%\oracle\bin\awt.dll
%APPDATA%\oracle\bin\bci.dll
%APPDATA%\oracle\bin\dcpr.dll
%APPDATA%\oracle\bin\decora_sse.dll
%APPDATA%\oracle\bin\deploy.dll
%APPDATA%\oracle\readme.txt
%APPDATA%\oracle\bin\dt_shmem.dll
%APPDATA%\oracle\bin\eula.dll
%APPDATA%\oracle\bin\fontmanager.dll
%APPDATA%\oracle\bin\fxplugins.dll
%APPDATA%\oracle\bin\glass.dll
%APPDATA%\oracle\bin\glib-lite.dll
%APPDATA%\oracle\bin\gstreamer-lite.dll
%APPDATA%\oracle\bin\hprof.dll
%APPDATA%\oracle\bin\instrument.dll
%APPDATA%\oracle\bin\jp2iexp.dll
%APPDATA%\oracle\bin\dt_socket.dll
%APPDATA%\oracle\bin\jp2launcher.exe
%APPDATA%\oracle\bin\java-rmi.exe
%APPDATA%\oracle\bin\jp2native.dll
%APPDATA%\oracle\bin\rmiregistry.exe
%APPDATA%\oracle\bin\splashscreen.dll
%APPDATA%\oracle\bin\ssv.dll
%APPDATA%\oracle\bin\ssvagent.exe
%APPDATA%\oracle\bin\sunec.dll
%APPDATA%\oracle\bin\sunmscapi.dll
%APPDATA%\oracle\bin\t2k.dll
%APPDATA%\oracle\bin\tnameserv.exe
%APPDATA%\oracle\bin\unpack.dll
%APPDATA%\oracle\bin\unpack200.exe
%APPDATA%\oracle\bin\verify.dll
%APPDATA%\oracle\bin\w2k_lsa_auth.dll
%APPDATA%\oracle\bin\windowsaccessbridge-64.dll
%APPDATA%\oracle\bin\wsdetect.dll
%APPDATA%\oracle\bin\zip.dll
%APPDATA%\oracle\bin\dtplugin\deployjava1.dll
%APPDATA%\oracle\bin\dtplugin\npdeployjava1.dll
%APPDATA%\oracle\bin\plugin2\msvcr100.dll
%APPDATA%\oracle\bin\plugin2\npjp2.dll
%APPDATA%\oracle\bin\server\classes.jsa
%APPDATA%\oracle\bin\rmid.exe
%APPDATA%\oracle\bin\jp2ssv.dll
%APPDATA%\oracle\bin\servertool.exe
%APPDATA%\oracle\lib\images\cursors\invalid32x32.gif
%TEMP%\hsperfdata_user\2216
%APPDATA%\oracle\bin\prism_es2.dll
%APPDATA%\oracle\bin\jsdt.dll
%APPDATA%\oracle\bin\jsound.dll
%APPDATA%\oracle\bin\jsoundds.dll
%APPDATA%\oracle\bin\kcms.dll
%APPDATA%\oracle\bin\keytool.exe
%APPDATA%\oracle\bin\kinit.exe
%APPDATA%\oracle\bin\klist.exe
%APPDATA%\oracle\bin\ktab.exe
%APPDATA%\oracle\bin\lcms.dll
%APPDATA%\oracle\bin\jpeg.dll
%APPDATA%\oracle\bin\management.dll
%APPDATA%\oracle\bin\msvcr100.dll
%APPDATA%\oracle\bin\net.dll
%APPDATA%\oracle\bin\nio.dll
%APPDATA%\oracle\bin\npt.dll
%APPDATA%\oracle\bin\orbd.exe
%APPDATA%\oracle\bin\pack200.exe
%APPDATA%\oracle\bin\policytool.exe
%APPDATA%\oracle\bin\prism_common.dll
%APPDATA%\oracle\bin\prism_d3d.dll
%APPDATA%\oracle\bin\mlib_image.dll
%APPDATA%\oracle\bin\resource.dll
%TEMP%\abcdefghijkl7928229413666012045.reg

Sets the 'hidden' attribute to the following files

%HOMEPATH%\fcnjig8pbdh\3vxav2monqb.tqdto2
%HOMEPATH%\fcnjig8pbdh\id.txt

Network activity

UDP

DNS ASK ca####1388.ddns.net

Miscellaneous

Searches for the following windows

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%APPDATA%\oracle\bin\javaw.exe' -jar %HOMEPATH%\FCNJIG8Pbdh\3vXAV2MonQb.TqdTo2

Executes the following

'<SYSTEM32>\xcopy.exe' "%ProgramFiles%\Java\jre1.8.0_45" "%APPDATA%\Oracle\" /e
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v FR32GRfvap5 /t REG_SZ /d "\"%APPDATA%\Oracle\bin\javaw.exe\" -jar \"%HOMEPATH%\FCNJIG8Pbdh\3vXAV2MonQb.TqdTo2\"" /f
'<SYSTEM32>\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FR32GRfvap5 /f
'<SYSTEM32>\attrib.exe' +h "%HOMEPATH%\FCNJIG8Pbdh\*.*"
'<SYSTEM32>\attrib.exe' +h "%HOMEPATH%\FCNJIG8Pbdh"
'<SYSTEM32>\cmd.exe' /c regedit.exe /s %TEMP%\abcdefghijkl7928229413666012045.reg
'%WINDIR%\regedit.exe' /s %TEMP%\abcdefghijkl7928229413666012045.reg

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial