Trojan.DownLoader10.29621

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528LOL.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Arbeiten.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Lehrerarbeit.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Cool.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Seiten_entsperren.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Aufsatz.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528AB.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528AntiVirus.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Minecraft_Codes.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Info.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Schule.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Diktat.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Hallo.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Rektor.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Englisch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Mathe.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Deutsch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Biologie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Whitney.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Recherche.exe"
'<SYSTEM32>\attrib.exe' /pid=2864
'<SYSTEM32>\attrib.exe' +r "<Current directory>\Anita.exe"
'<SYSTEM32>\attrib.exe' /pid=3820
'<SYSTEM32>\attrib.exe' +r +h "<Current directory>\\3166.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Informatik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Arbeitsblatt.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Elternbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Liebesbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Elisabeth.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Burak.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Jonas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Roksana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Tim.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Fabian.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Sandra.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Anita.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Recherche.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Chemie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Biologie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Whitney.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Pia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Rene.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Lana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Maria.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Niklas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Saskia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Daniel.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Sven.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Patrick.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Oliver.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Dominik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Alina.exe"
'<SYSTEM32>\attrib.exe' /pid=3612
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Marigona.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Chantal.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Ellen.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Benjamin.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Lana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Aufsatz.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166AB.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Cool.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Seiten_entsperren.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Informatik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\AntiVirus.exe"
'<SYSTEM32>\attrib.exe' +r +h "<Current directory>\\19272.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Hallo.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Rektor.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Schule.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Diktat.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166LOL.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Arbeiten.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Lehrerarbeit.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Recherche.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Chemie.exe"
'<SYSTEM32>\attrib.exe' /pid=2344
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Whitney.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Pia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Rene.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Lana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Arbeitsblatt.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Elternbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Liebesbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Deutsch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Biologie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Englisch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\19272Mathe.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166AntiVirus.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Fabian.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Sandra.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Anita.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Alina.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Benjamin.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Marigona.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Dominik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Roksana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Pia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Rene.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Jonas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Tim.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Burak.exe"
'<SYSTEM32>\attrib.exe' /pid=2796
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Patrick.exe"
'<SYSTEM32>\attrib.exe' /pid=2860
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Oliver.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Sven.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Minecraft_Codes.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Info.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Elisabeth.exe"
'<SYSTEM32>\attrib.exe' /pid=756
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Chantal.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Ellen.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Saskia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Daniel.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Maria.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\3166Niklas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Sven.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Patrick.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Oliver.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Elisabeth.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\AntiVirus.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Minecraft_Codes.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Info.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Chantal.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Ellen.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Benjamin.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Saskia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Daniel.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Maria.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Niklas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Aufsatz.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\AB.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Cool.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Seiten_entsperren.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Informatik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\AB.exe"
'<SYSTEM32>\attrib.exe' +r +h "<Current directory>\\8013.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Hallo.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Rektor.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Schule.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Diktat.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\LOL.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Arbeiten.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Lehrerarbeit.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Marigona.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Deutsch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Arbeitsblatt.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Elternbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Mathe.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Chemie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Biologie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Englisch.exe"
'<SYSTEM32>\attrib.exe' +r +h "<Current directory>\\11756.exe"
'<SYSTEM32>\mode.com' 20,20
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\wrfle.bat" "
'<SYSTEM32>\attrib.exe' +r "<Full path to virus>"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Liebesbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Informatik.exe"
'<SYSTEM32>\attrib.exe' +r +h "words"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Anita.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Tim.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Burak.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Sandra.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Dominik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Alina.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Fabian.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Lana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Whitney.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Recherche.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Rene.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Jonas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Roksana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\Pia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Liebesbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Hallo.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Rektor.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Schule.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Diktat.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013LOL.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Arbeiten.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Lehrerarbeit.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Sven.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Patrick.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Oliver.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Elisabeth.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013AntiVirus.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Minecraft_Codes.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Info.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Elternbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Liebesbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Informatik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Arbeitsblatt.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Englisch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Mathe.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\21528Deutsch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Aufsatz.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013AB.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Cool.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Seiten_entsperren.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\Alina.exe"
'<SYSTEM32>\attrib.exe' +r +h "<Current directory>\\21528.exe"
'<SYSTEM32>\attrib.exe' /pid=2656
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Daniel.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Lana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Whitney.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Recherche.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Rene.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Jonas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Roksana.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Pia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Deutsch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Arbeitsblatt.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Elternbrief.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Mathe.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Chemie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Biologie.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Englisch.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Ellen.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Benjamin.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Marigona.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Chantal.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Maria.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Niklas.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Saskia.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Anita.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Tim.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Burak.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Sandra.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Dominik.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Alina.exe"
'<SYSTEM32>\attrib.exe' +r "<Current directory>\\8013Fabian.exe"

Injects code into

the following system processes:

<SYSTEM32>\cmd.exe
<SYSTEM32>\attrib.exe

Modifies file system :

Creates the following files:

<Current directory>\21528Diktat.exe
<Current directory>\21528Hallo.exe
<Current directory>\21528Rektor.exe
<Current directory>\21528LOL.exe
<Current directory>\21528Arbeiten.exe
<Current directory>\21528Lehrerarbeit.exe
<Current directory>\21528Schule.exe
<Current directory>\21528Elisabeth.exe
<Current directory>\21528Sven.exe
<Current directory>\21528Patrick.exe
<Current directory>\21528AntiVirus.exe
<Current directory>\21528Minecraft_Codes.exe
<Current directory>\21528Info.exe
<Current directory>\3166Mathe.exe
<Current directory>\3166Deutsch.exe
<Current directory>\3166Arbeitsblatt.exe
<Current directory>\3166Chemie.exe
<Current directory>\3166Biologie.exe
<Current directory>\3166Englisch.exe
<Current directory>\3166Elternbrief.exe
<Current directory>\21528Aufsatz.exe
<Current directory>\21528AB.exe
<Current directory>\21528Cool.exe
<Current directory>\3166Liebesbrief.exe
<Current directory>\3166Informatik.exe
<Current directory>\21528Seiten_entsperren.exe
<Current directory>\21528Oliver.exe
<Current directory>\21528Roksana.exe
<Current directory>\21528Pia.exe
<Current directory>\21528Rene.exe
<Current directory>\21528Tim.exe
<Current directory>\21528Burak.exe
<Current directory>\21528Jonas.exe
<Current directory>\21528Lana.exe
<Current directory>\21528Biologie.exe
<Current directory>\21528Englisch.exe
<Current directory>\21528Mathe.exe
<Current directory>\21528Whitney.exe
<Current directory>\21528Recherche.exe
<Current directory>\21528Chemie.exe
<Current directory>\21528Saskia.exe
<Current directory>\21528Chantal.exe
<Current directory>\21528Ellen.exe
<Current directory>\21528Daniel.exe
<Current directory>\21528Maria.exe
<Current directory>\21528Niklas.exe
<Current directory>\21528Benjamin.exe
<Current directory>\21528Fabian.exe
<Current directory>\21528Sandra.exe
<Current directory>\21528Anita.exe
<Current directory>\21528Marigona.exe
<Current directory>\21528Dominik.exe
<Current directory>\21528Alina.exe
<Current directory>\3166Recherche.exe
<Current directory>\3166AB.exe
<Current directory>\3166Cool.exe
<Current directory>\3166LOL.exe
<Current directory>\19272Informatik.exe
<Current directory>\3166Seiten_entsperren.exe
<Current directory>\3166Aufsatz.exe
<Current directory>\3166Arbeiten.exe
<Current directory>\3166Rektor.exe
<Current directory>\3166Schule.exe
<Current directory>\3166AntiVirus.exe
<Current directory>\3166Lehrerarbeit.exe
<Current directory>\3166Diktat.exe
<Current directory>\3166Hallo.exe
<Current directory>\19272Whitney.exe
<Current directory>\19272Recherche.exe
<Current directory>\19272Chemie.exe
<Current directory>\19272Pia.exe
<Current directory>\19272Rene.exe
<Current directory>\19272Lana.exe
<Current directory>\19272Biologie.exe
<Current directory>\19272Arbeitsblatt.exe
<Current directory>\19272Elternbrief.exe
<Current directory>\19272Liebesbrief.exe
<Current directory>\19272Englisch.exe
<Current directory>\19272Mathe.exe
<Current directory>\19272Deutsch.exe
<Current directory>\3166Minecraft_Codes.exe
<Current directory>\3166Sandra.exe
<Current directory>\3166Anita.exe
<Current directory>\3166Tim.exe
<Current directory>\3166Dominik.exe
<Current directory>\3166Alina.exe
<Current directory>\3166Fabian.exe
<Current directory>\3166Burak.exe
<Current directory>\3166Rene.exe
<Current directory>\3166Lana.exe
<Current directory>\3166Whitney.exe
<Current directory>\3166Jonas.exe
<Current directory>\3166Roksana.exe
<Current directory>\3166Pia.exe
<Current directory>\3166Patrick.exe
<Current directory>\3166Oliver.exe
<Current directory>\3166Daniel.exe
<Current directory>\3166Info.exe
<Current directory>\3166Elisabeth.exe
<Current directory>\3166Sven.exe
<Current directory>\3166Maria.exe
<Current directory>\3166Ellen.exe
<Current directory>\3166Benjamin.exe
<Current directory>\3166Marigona.exe
<Current directory>\3166Niklas.exe
<Current directory>\3166Saskia.exe
<Current directory>\3166Chantal.exe
<Current directory>\21528Deutsch.exe
<Current directory>\Patrick.exe
<Current directory>\Oliver.exe
<Current directory>\Daniel.exe
<Current directory>\Info.exe
<Current directory>\Elisabeth.exe
<Current directory>\Sven.exe
<Current directory>\Maria.exe
<Current directory>\Ellen.exe
<Current directory>\Benjamin.exe
<Current directory>\Marigona.exe
<Current directory>\Niklas.exe
<Current directory>\Saskia.exe
<Current directory>\Chantal.exe
<Current directory>\Cool.exe
<Current directory>\LOL.exe
<Current directory>\Arbeiten.exe
<Current directory>\Seiten_entsperren.exe
<Current directory>\Aufsatz.exe
<Current directory>\AB.exe
<Current directory>\Lehrerarbeit.exe
<Current directory>\Schule.exe
<Current directory>\AntiVirus.exe
<Current directory>\Minecraft_Codes.exe
<Current directory>\Diktat.exe
<Current directory>\Hallo.exe
<Current directory>\Rektor.exe
<Current directory>\Dominik.exe
<Current directory>\Mathe.exe
<Current directory>\Deutsch.exe
<Current directory>\Arbeitsblatt.exe
<Current directory>\Chemie.exe
<Current directory>\Biologie.exe
<Current directory>\Englisch.exe
<Current directory>\Elternbrief.exe
<Current directory>\words
<Full path to virus>
%TEMP%\1.tmp\wrfle.bat
<Current directory>\Liebesbrief.exe
<Current directory>\Informatik.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\infected[1].php
<Current directory>\Anita.exe
<Current directory>\Tim.exe
<Current directory>\Burak.exe
<Current directory>\Alina.exe
<Current directory>\Fabian.exe
<Current directory>\Sandra.exe
<Current directory>\Jonas.exe
<Current directory>\Lana.exe
<Current directory>\Whitney.exe
<Current directory>\Recherche.exe
<Current directory>\Roksana.exe
<Current directory>\Pia.exe
<Current directory>\Rene.exe
<Current directory>\8013Informatik.exe
<Current directory>\8013Minecraft_Codes.exe
<Current directory>\8013Info.exe
<Current directory>\8013Elisabeth.exe
<Current directory>\8013Rektor.exe
<Current directory>\8013Schule.exe
<Current directory>\8013AntiVirus.exe
<Current directory>\8013Sven.exe
<Current directory>\8013Maria.exe
<Current directory>\8013Niklas.exe
<Current directory>\8013Saskia.exe
<Current directory>\8013Patrick.exe
<Current directory>\8013Oliver.exe
<Current directory>\8013Daniel.exe
<Current directory>\21528Informatik.exe
<Current directory>\8013Seiten_entsperren.exe
<Current directory>\8013Aufsatz.exe
<Current directory>\21528Arbeitsblatt.exe
<Current directory>\21528Elternbrief.exe
<Current directory>\21528Liebesbrief.exe
<Current directory>\8013AB.exe
<Current directory>\8013Lehrerarbeit.exe
<Current directory>\8013Diktat.exe
<Current directory>\8013Hallo.exe
<Current directory>\8013Cool.exe
<Current directory>\8013LOL.exe
<Current directory>\8013Arbeiten.exe
<Current directory>\8013Chantal.exe
<Current directory>\8013Recherche.exe
<Current directory>\8013Chemie.exe
<Current directory>\8013Biologie.exe
<Current directory>\8013Rene.exe
<Current directory>\8013Lana.exe
<Current directory>\8013Whitney.exe
<Current directory>\8013Englisch.exe
<Current directory>\8013Elternbrief.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\infected[1].php
<Current directory>\8013Liebesbrief.exe
<Current directory>\8013Mathe.exe
<Current directory>\8013Deutsch.exe
<Current directory>\8013Arbeitsblatt.exe
<Current directory>\8013Dominik.exe
<Current directory>\8013Alina.exe
<Current directory>\8013Fabian.exe
<Current directory>\8013Ellen.exe
<Current directory>\8013Benjamin.exe
<Current directory>\8013Marigona.exe
<Current directory>\8013Sandra.exe
<Current directory>\8013Jonas.exe
<Current directory>\8013Roksana.exe
<Current directory>\8013Pia.exe
<Current directory>\8013Anita.exe
<Current directory>\8013Tim.exe
<Current directory>\8013Burak.exe

Sets the 'hidden' attribute to the following files:

<Current directory>\3166.exe
<Current directory>\19272.exe
<Current directory>\21528.exe
<Current directory>\words
<Current directory>\8013.exe

Deletes the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\infected[1].php

Moves the following files:

from <Current directory>\Anita.exe to <Current directory>\3166.exe
from <Current directory>\AntiVirus.exe to <Current directory>\19272.exe
from <Current directory>\AB.exe to <Current directory>\8013.exe
from <Current directory>\Alina.exe to <Current directory>\21528.exe

Moves itself:

from <Full path to virus> to <Current directory>\11756.exe

Network activity:

Connects to:

'localhost':1038
'rs#.##talhost.de':80
'localhost':1035

TCP:

HTTP GET requests:

rs#.##talhost.de/infected.php?us##################################################################################################################################

UDP:

DNS ASK rs#.##talhost.de

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'IEFrame' WindowName: '(null)'
ClassName: '' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial