Trojan.MulDrop32.15910

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Chrome' = '"%LOCALAPPDATA%\3257CE38-1BB0-5AD5-57D7-64FFB344B343\Chrome.exe" '
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKCU\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\mimicfile\shell\open\command] '' = 'notepad.exe "%LOCALAPPDATA%\Important_Notice.txt"'

Creates the following files on removable media

<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\istanbul.exe
%TEMP%\7zipsfx.000\xdel.exe
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\7za.exe
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\everything.exe
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\everything.ini
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\everything2.ini
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\everything32.dll
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\everything64.dll
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\xdel.exe
%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\session.tmp
C:\temp\session.tmp
C:\important_notice.txt
%TEMP%\7zsfx000.cmd
%LOCALAPPDATA%\important_notice.txt

Deletes the following files

%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zipsfx.000\istanbul.exe
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zsfx000.cmd

Moves the following files

from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\steam\steam.exe to %ProgramFiles(x86)%\steam\steam.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prcr.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prcr.x3d.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\proof\msth7es.lex to %ProgramFiles%\microsoft office\office14\proof\msth7es.lex.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex to %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\proof\msth7en.lex to %ProgramFiles%\microsoft office\office14\proof\msth7en.lex.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\infopath.exe to %ProgramFiles%\microsoft office\office14\infopath.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\mset7ge.kic to %ProgramFiles%\microsoft office\office14\mset7ge.kic.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\groove.exe to %ProgramFiles%\microsoft office\office14\groove.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\installed_resources14.xss to %ProgramFiles%\microsoft office\office14\installed_resources14.xss.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\pptico.exe to %ProgramFiles%\microsoft office\office14\pptico.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\outlook.exe to %ProgramFiles%\microsoft office\office14\outlook.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\excel.exe to %ProgramFiles%\microsoft office\office14\excel.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\excelcnv.exe to %ProgramFiles%\microsoft office\office14\excelcnv.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\graph.exe to %ProgramFiles%\microsoft office\office14\graph.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\mspub.exe to %ProgramFiles%\microsoft office\office14\mspub.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\msaccess.exe to %ProgramFiles%\microsoft office\office14\msaccess.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu to %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu to %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\winword.hxs to %ProgramFiles%\microsoft office\office14\1033\winword.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs to %ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\excel.hxs to %ProgramFiles%\microsoft office\office14\1033\excel.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx to %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx to %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\fiverules.potx to %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx to %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\outlook.hxs to %ProgramFiles%\microsoft office\office14\1033\outlook.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\groove.hxs to %ProgramFiles%\microsoft office\office14\1033\groove.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\msaccess.hxs to %ProgramFiles%\microsoft office\office14\1033\msaccess.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\outlfltr.dat to %ProgramFiles%\microsoft office\office14\outlfltr.dat.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\dvd maker\dvdmaker.exe to %ProgramFiles%\dvd maker\dvdmaker.exe.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground_pal.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground_pal.wmv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsscenesbackground.wmv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground_pal.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground_pal.wmv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsnotesbackground.wmv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsmainbackground_pal.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsmainbackground_pal.wmv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsmainbackground.wmv to %ProgramFiles%\dvd maker\shared\dvdstyles\sports\sportsmainbackground.wmv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\advzip.dic to %ProgramFiles%\microsoft office\office14\advzip.dic.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\mset7db.kic to %ProgramFiles%\microsoft office\office14\mset7db.kic.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv to %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\pubwiz\invite.dpv to %ProgramFiles%\microsoft office\office14\pubwiz\invite.dpv.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat to %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\1033\xmlsdk5.chm to %ProgramFiles%\microsoft office\office14\1033\xmlsdk5.chm.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\proof\msgr3en.lex to %ProgramFiles%\microsoft office\office14\proof\msgr3en.lex.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\pubwiz\news98.poc to %ProgramFiles%\microsoft office\office14\pubwiz\news98.poc.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\pubwiz\brchur98.poc to %ProgramFiles%\microsoft office\office14\pubwiz\brchur98.poc.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\advtel.dic to %ProgramFiles%\microsoft office\office14\advtel.dic.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
from %ProgramFiles%\microsoft office\office14\proof\msgr3es.lex to %ProgramFiles%\microsoft office\office14\proof\msgr3es.lex.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk

Modifies the following files

%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\startupcache.8.little.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\mozilla thunderbird\omni.ja.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\office14\mset7ge.kic.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\office14\installed_resources14.xss.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\fiverules.potx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk
%ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.istanbul-ko44skkb13b0rgtwo-eoa-rugzn4jwebkow7utvu2vk

Modifies multiple files.

Deletes itself.

Network activity

Connects to

'<LOCALNET>..67.0':445
'<LOCALNET>..67.1':445
'<LOCALNET>..67.2':445
'<LOCALNET>..67.3':445
'<LOCALNET>..67.4':445
'<LOCALNET>..67.5':445
'<LOCALNET>..67.6':445
'<LOCALNET>..67.7':445
'<LOCALNET>..67.8':445
'<LOCALNET>..67.9':445
'<LOCALNET>..67.10':445
'<LOCALNET>..67.11':445
'<LOCALNET>..67.12':445
'<LOCALNET>..67.13':445
'<LOCALNET>..67.14':445
'<LOCALNET>..67.15':445
'<LOCALNET>..67.16':445
'<LOCALNET>..67.17':445
'<LOCALNET>..67.18':445
'<LOCALNET>..67.19':445
'<LOCALNET>..67.20':445
'<LOCALNET>..67.21':445
'<LOCALNET>..67.22':445
'<LOCALNET>..67.23':445
'<LOCALNET>..67.24':445
'<LOCALNET>..67.25':445
'<LOCALNET>..67.26':445
'<LOCALNET>..67.27':445
'<LOCALNET>..67.28':445
'<LOCALNET>..67.29':445
'<LOCALNET>..67.30':445
'<LOCALNET>..67.31':445
'<LOCALNET>..67.32':445
'<LOCALNET>..67.33':445
'<LOCALNET>..67.34':445
'<LOCALNET>..67.35':445
'<LOCALNET>..67.36':445
'<LOCALNET>..67.37':445
'<LOCALNET>..67.38':445
'<LOCALNET>..67.39':445
'<LOCALNET>..67.40':445
'<LOCALNET>..67.41':445
'<LOCALNET>..67.42':445
'<LOCALNET>..67.43':445
'<LOCALNET>..67.44':445
'<LOCALNET>..67.45':445
'<LOCALNET>..67.46':445
'<LOCALNET>..67.47':445
'<LOCALNET>..67.48':445
'<LOCALNET>..67.49':445
'<LOCALNET>..67.50':445
'<LOCALNET>..67.51':445
'<LOCALNET>..67.52':445
'<LOCALNET>..67.53':445
'<LOCALNET>..67.54':445
'<LOCALNET>..67.55':445
'<LOCALNET>..67.56':445
'<LOCALNET>..67.57':445
'<LOCALNET>..67.58':445
'<LOCALNET>..67.59':445
'<LOCALNET>..67.60':445
'<LOCALNET>..67.61':445
'<LOCALNET>..67.62':445
'<LOCALNET>..67.63':445
'<LOCALNET>..67.64':445
'<LOCALNET>..67.65':445
'<LOCALNET>..67.66':445
'<LOCALNET>..67.67':445
'<LOCALNET>..67.68':445
'<LOCALNET>..67.69':445
'<LOCALNET>..67.70':445
'<LOCALNET>..67.71':445
'<LOCALNET>..67.72':445
'<LOCALNET>..67.73':445
'<LOCALNET>..67.74':445
'<LOCALNET>..67.75':445
'<LOCALNET>..67.76':445
'<LOCALNET>..67.77':445
'<LOCALNET>..67.78':445
'<LOCALNET>..67.79':445
'<LOCALNET>..67.80':445
'<LOCALNET>..67.81':445
'<LOCALNET>..67.82':445
'<LOCALNET>..67.83':445
'<LOCALNET>..67.84':445
'<LOCALNET>..67.85':445
'<LOCALNET>..67.86':445
'<LOCALNET>..67.87':445
'<LOCALNET>..67.88':445
'<LOCALNET>..67.89':445
'<LOCALNET>..67.90':445
'<LOCALNET>..67.91':445
'<LOCALNET>..67.92':445
'<LOCALNET>..67.93':445
'<LOCALNET>..67.94':445
'<LOCALNET>..67.95':445
'<LOCALNET>..67.96':445
'<LOCALNET>..67.97':445
'<LOCALNET>..67.98':445
'<LOCALNET>..67.99':445
'<LOCALNET>..67.100':445
'<LOCALNET>..67.101':445
'<LOCALNET>..67.102':445
'<LOCALNET>..67.103':445
'<LOCALNET>..67.104':445
'<LOCALNET>..67.105':445
'<LOCALNET>..67.106':445
'<LOCALNET>..67.107':445
'<LOCALNET>..67.108':445
'<LOCALNET>..67.109':445
'<LOCALNET>..67.110':445
'<LOCALNET>..67.111':445
'<LOCALNET>..67.112':445
'<LOCALNET>..67.113':445
'<LOCALNET>..67.114':445
'<LOCALNET>..67.115':445
'<LOCALNET>..67.116':445
'<LOCALNET>..67.117':445
'<LOCALNET>..67.118':445
'<LOCALNET>..67.119':445
'<LOCALNET>..67.120':445
'<LOCALNET>..67.121':445
'<LOCALNET>..67.122':445
'<LOCALNET>..67.123':445
'<LOCALNET>..67.124':445
'<LOCALNET>..67.125':445
'<LOCALNET>..67.126':445
'<LOCALNET>..67.127':445
'<LOCALNET>..67.128':445
'<LOCALNET>..67.129':445
'<LOCALNET>..67.130':445
'<LOCALNET>..67.131':445
'<LOCALNET>..67.132':445
'<LOCALNET>..67.133':445
'<LOCALNET>..67.134':445
'<LOCALNET>..67.135':445
'<LOCALNET>..67.136':445
'<LOCALNET>..67.137':445
'<LOCALNET>..67.138':445
'<LOCALNET>..67.139':445
'<LOCALNET>..67.140':445
'<LOCALNET>..67.141':445
'<LOCALNET>..67.142':445
'<LOCALNET>..67.143':445
'<LOCALNET>..67.144':445
'<LOCALNET>..67.145':445
'<LOCALNET>..67.146':445
'<LOCALNET>..67.147':445
'<LOCALNET>..67.148':445
'<LOCALNET>..67.149':445
'<LOCALNET>..67.150':445
'<LOCALNET>..67.151':445
'<LOCALNET>..67.152':445
'<LOCALNET>..67.153':445
'<LOCALNET>..67.154':445
'<LOCALNET>..67.155':445
'<LOCALNET>..67.156':445
'<LOCALNET>..67.157':445
'<LOCALNET>..67.158':445
'<LOCALNET>..67.159':445
'<LOCALNET>..67.160':445
'<LOCALNET>..67.161':445
'<LOCALNET>..67.162':445
'<LOCALNET>..67.163':445
'<LOCALNET>..67.164':445
'<LOCALNET>..67.165':445
'<LOCALNET>..67.166':445
'<LOCALNET>..67.167':445
'<LOCALNET>..67.168':445
'<LOCALNET>..67.169':445
'<LOCALNET>..67.170':445
'<LOCALNET>..67.171':445
'<LOCALNET>..67.172':445
'<LOCALNET>..67.173':445
'<LOCALNET>..67.174':445
'<LOCALNET>..67.175':445
'<LOCALNET>..67.176':445
'<LOCALNET>..67.177':445
'<LOCALNET>..67.178':445
'<LOCALNET>..67.179':445
'<LOCALNET>..67.180':445
'<LOCALNET>..67.181':445
'<LOCALNET>..67.182':445
'<LOCALNET>..67.183':445
'<LOCALNET>..67.184':445
'<LOCALNET>..67.185':445
'<LOCALNET>..67.186':445
'<LOCALNET>..67.187':445
'<LOCALNET>..67.188':445
'<LOCALNET>..67.189':445
'<LOCALNET>..67.190':445
'<LOCALNET>..67.191':445
'<LOCALNET>..67.192':445
'<LOCALNET>..67.193':445
'<LOCALNET>..67.194':445
'<LOCALNET>..67.195':445
'<LOCALNET>..67.196':445
'<LOCALNET>..67.197':445
'<LOCALNET>..67.198':445
'<LOCALNET>..67.199':445
'<LOCALNET>..67.200':445
'<LOCALNET>..67.201':445
'<LOCALNET>..67.202':445
'<LOCALNET>..67.203':445
'<LOCALNET>..67.204':445
'<LOCALNET>..67.205':445
'<LOCALNET>..67.206':445
'<LOCALNET>..67.207':445
'<LOCALNET>..67.208':445
'<LOCALNET>..67.209':445
'<LOCALNET>..67.210':445
'<LOCALNET>..67.211':445
'<LOCALNET>..67.212':445
'<LOCALNET>..67.213':445
'<LOCALNET>..67.214':445
'<LOCALNET>..67.215':445
'<LOCALNET>..67.216':445
'<LOCALNET>..67.217':445
'<LOCALNET>..67.218':445
'<LOCALNET>..67.219':445
'<LOCALNET>..67.220':445
'<LOCALNET>..67.221':445
'<LOCALNET>..67.222':445
'<LOCALNET>..67.223':445
'<LOCALNET>..67.224':445
'<LOCALNET>..67.225':445
'<LOCALNET>..67.226':445
'<LOCALNET>..67.227':445
'<LOCALNET>..67.228':445
'<LOCALNET>..67.229':445
'<LOCALNET>..67.230':445
'<LOCALNET>..67.231':445
'<LOCALNET>..67.232':445
'<LOCALNET>..67.233':445
'<LOCALNET>..67.234':445
'<LOCALNET>..67.235':445
'<LOCALNET>..67.236':445
'<LOCALNET>..67.237':445
'<LOCALNET>..67.238':445
'<LOCALNET>..67.239':445
'<LOCALNET>..67.240':445
'<LOCALNET>..67.241':445
'<LOCALNET>..67.242':445
'<LOCALNET>..67.243':445
'<LOCALNET>..67.244':445
'<LOCALNET>..67.245':445
'<LOCALNET>..67.246':445
'<LOCALNET>..67.247':445
'<LOCALNET>..67.248':445
'<LOCALNET>..67.249':445
'<LOCALNET>..67.250':445
'<LOCALNET>..67.251':445
'<LOCALNET>..67.252':445
'<LOCALNET>..67.253':445
'<LOCALNET>..67.254':445

Miscellaneous

Searches for the following windows

ClassName: 'EVERYTHING_TASKBAR_NOTIFICATION' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\7za.exe' i
'%TEMP%\7zipsfx.000\7za.exe' x -y -p2571925622236027778 Everything64.dll
'%TEMP%\7zipsfx.000\istanbul.exe'
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe'
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\everything.exe' -startup
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe' -e watch -pid 1128 -!
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe' -e ul1
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe' -e ul2

Executes the following

'<SYSTEM32>\powercfg.exe' -H off
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
'%TEMP%\7zipsfx.000\7za.exe' i' (with hidden window)
'%TEMP%\7zipsfx.000\7za.exe' x -y -p2571925622236027778 Everything64.dll' (with hidden window)
'%TEMP%\7zipsfx.000\istanbul.exe' ' (with hidden window)
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe' ' (with hidden window)
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\everything.exe' -startup' (with hidden window)
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe' -e watch -pid 1128 -!' (with hidden window)
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe' -e ul1' (with hidden window)
'%LOCALAPPDATA%\3257ce38-1bb0-5ad5-57d7-64ffb344b343\chrome.exe' -e ul2' (with hidden window)
'<SYSTEM32>\powercfg.exe' -H off' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial