Trojan.DownLoader10.57349

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'system' = '%APPDATA%\system\drivers.exe'

Malicious functions:

Creates and executes the following:

'%HOMEPATH%\Q69S\ikv.exe'

Executes the following:

'<SYSTEM32>\attrib.exe' -s -h %APPDATA%\system
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'

Injects code into

the following system processes:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Q69S\10116.FTZ
%HOMEPATH%\Q69S\C94947.ZRE
%HOMEPATH%\Q69S\O93983.XPA
%HOMEPATH%\Q69S\39934.GKM
%HOMEPATH%\Q69S\Z24188.HQA
%HOMEPATH%\Q69S\K59296.LBT
%HOMEPATH%\Q69S\75921.CVM
%HOMEPATH%\Q69S\60747.BMH
%HOMEPATH%\Q69S\X55122.ZCK
%HOMEPATH%\Q69S\50493.AXI
%HOMEPATH%\Q69S\L39536.TCI
%HOMEPATH%\Q69S\Z46677.OZJ
%HOMEPATH%\Q69S\49515.NCY
%HOMEPATH%\Q69S\R90817.TXF
%HOMEPATH%\Q69S\K24744.LGW
%HOMEPATH%\Q69S\63552.OWW
%HOMEPATH%\Q69S\17240.ITY
%HOMEPATH%\Q69S\3600.UHR
%HOMEPATH%\Q69S\C42415.PBM
%HOMEPATH%\Q69S\G54909.QUZ
%HOMEPATH%\Q69S\B64785.LLA
%HOMEPATH%\Q69S\35711.IBX
%HOMEPATH%\Q69S\P10152.PKM
%HOMEPATH%\Q69S\E13372.PTF
%HOMEPATH%\Q69S\46248.EUS
%HOMEPATH%\Q69S\43142.ANU
%HOMEPATH%\Q69S\79247.AIE
%HOMEPATH%\Q69S\G16546.GKF
%HOMEPATH%\Q69S\O55706.IRS
%HOMEPATH%\Q69S\81121.YXJ
%HOMEPATH%\Q69S\P18026.UNN
%HOMEPATH%\Q69S\C67447.BLZ
%HOMEPATH%\Q69S\62687.DEJ
%HOMEPATH%\Q69S\39882.KHI
%HOMEPATH%\Q69S\O19395.EXK
%HOMEPATH%\Q69S\V38047.XBP
%HOMEPATH%\Q69S\19842.PGR
%HOMEPATH%\Q69S\X71256.TMD
%HOMEPATH%\Q69S\X65678.XIS
%HOMEPATH%\Q69S\1041.QTJ
%HOMEPATH%\Q69S\28299.CKJ
%HOMEPATH%\Q69S\C42439.OZN
%HOMEPATH%\Q69S\R11486.IXL
%HOMEPATH%\Q69S\7419.YMG
%HOMEPATH%\Q69S\D85249.LQT
%HOMEPATH%\Q69S\M39636.BCC
%HOMEPATH%\Q69S\92872.CRE
%HOMEPATH%\Q69S\52440.VCQ
%HOMEPATH%\Q69S\X15073.GLN
%HOMEPATH%\Q69S\7855.UWT
%HOMEPATH%\Q69S\47495.OBJ
%HOMEPATH%\Q69S\49003.YUX
%HOMEPATH%\Q69S\18932.APF
%HOMEPATH%\Q69S\44506.YFO
%HOMEPATH%\Q69S\M41039.QRF
%HOMEPATH%\Q69S\35055.DXU
%HOMEPATH%\Q69S\E68072.GXN
%HOMEPATH%\Q69S\1593.XOW
%HOMEPATH%\Q69S\D65346.HNS
%HOMEPATH%\Q69S\X61230.RPR
%HOMEPATH%\Q69S\33270.QOR
%HOMEPATH%\Q69S\37802.DPU
%HOMEPATH%\Q69S\B3193.SBR
%HOMEPATH%\Q69S\S34112.DJM
%HOMEPATH%\Q69S\W52119.BWT
%HOMEPATH%\Q69S\68941.DXH
%HOMEPATH%\Q69S\46110.SBK
%HOMEPATH%\Q69S\C19576.FLK
%HOMEPATH%\Q69S\69620.GBZ
%HOMEPATH%\Q69S\97120.WHR
%HOMEPATH%\Q69S\90920.SVU
%HOMEPATH%\Q69S\V10065.KKU
%HOMEPATH%\Q69S\R42956.NHM
%HOMEPATH%\Q69S\82391.MZH
%HOMEPATH%\Q69S\T63694.BEP
%HOMEPATH%\Q69S\C61325.MTD
%HOMEPATH%\Q69S\V37882.IUW
%HOMEPATH%\Q69S\M35327.HGV
%HOMEPATH%\Q69S\74180.EWL
%HOMEPATH%\Q69S\29590.VDG
%HOMEPATH%\Q69S\S5546.RDE
%HOMEPATH%\Q69S\Q67554.OVM
%HOMEPATH%\Q69S\69275.NRG
%HOMEPATH%\Q69S\X58963.KQR
%HOMEPATH%\Q69S\86560.JNL
%HOMEPATH%\Q69S\5841.BHV
%HOMEPATH%\Q69S\C4955.VWU
%HOMEPATH%\Q69S\66716.FIH
%HOMEPATH%\Q69S\8469.OIA
%HOMEPATH%\Q69S\79986.EGA
%HOMEPATH%\Q69S\X45497.LLD
%HOMEPATH%\Q69S\X51341.ABW
%HOMEPATH%\Q69S\P32419.TQO
%HOMEPATH%\Q69S\68398.ETC
%HOMEPATH%\Q69S\40938.PFI
%HOMEPATH%\Q69S\I57801.QTJ
%HOMEPATH%\Q69S\35483.HRO
%HOMEPATH%\Q69S\D86891.QIN
%HOMEPATH%\Q69S\50734.QQM
%HOMEPATH%\Q69S\L93521.VUU
%HOMEPATH%\Q69S\U10541.TMA
%HOMEPATH%\Q69S\51492.WWD
%HOMEPATH%\Q69S\70801.DRT
%HOMEPATH%\Q69S\P64906.KZL
%HOMEPATH%\Q69S\67803.DRT
%HOMEPATH%\Q69S\16168.ZJP
%HOMEPATH%\Q69S\77070.WDQ
%HOMEPATH%\Q69S\T11188.UJU
%HOMEPATH%\Q69S\K84585.DKV
%HOMEPATH%\Q69S\M14048.JAO
%HOMEPATH%\Q69S\U30488.BLP
%HOMEPATH%\Q69S\7463.ZPR
%HOMEPATH%\Q69S\J22147.HLS
%HOMEPATH%\Q69S\W69182.BTU
%HOMEPATH%\Q69S\K19108.DLE
%HOMEPATH%\Q69S\R87039.UCN
%HOMEPATH%\Q69S\D59084.YKT
%HOMEPATH%\Q69S\66150.FQB
%HOMEPATH%\Q69S\63205.ERJ
%HOMEPATH%\Q69S\92823.XWM
%HOMEPATH%\Q69S\H65597.SYL
%HOMEPATH%\Q69S\N61333.ECO
%HOMEPATH%\Q69S\34997.BQC
%HOMEPATH%\Q69S\98223.NAB
%HOMEPATH%\Q69S\53909.GTM
%HOMEPATH%\Q69S\50944.QRA
%HOMEPATH%\Q69S\P25967.BXU
%HOMEPATH%\Q69S\W58698.UGM
%HOMEPATH%\Q69S\R93392.YZE
%HOMEPATH%\Q69S\G21419.BIQ
%HOMEPATH%\Q69S\J91655.LLW
%HOMEPATH%\Q69S\X56694.FIP
%HOMEPATH%\Q69S\Y87157.TAF
%HOMEPATH%\Q69S\73428.KQX
%HOMEPATH%\Q69S\F96520.GOH
%HOMEPATH%\Q69S\N40735.LUU
%HOMEPATH%\Q69S\Z20435.FRS
%HOMEPATH%\Q69S\S70063.MTR
%HOMEPATH%\Q69S\85474.FVT
%HOMEPATH%\Q69S\74946.VDB
%HOMEPATH%\Q69S\52965.OTQ
%HOMEPATH%\Q69S\B1591.RQT
%HOMEPATH%\Q69S\38751.MYQ
%HOMEPATH%\Q69S\C89996.HRH
%HOMEPATH%\Q69S\D69545.MGG
%HOMEPATH%\Q69S\83983.CDI
%HOMEPATH%\Q69S\Y25143.SUX
%HOMEPATH%\Q69S\38153.CST
%HOMEPATH%\Q69S\E27894.GWV
%HOMEPATH%\Q69S\L81644.FPP
%HOMEPATH%\Q69S\34690.GIZ
%HOMEPATH%\Q69S\66460.OPE
%HOMEPATH%\Q69S\V35227.VNJ
%HOMEPATH%\Q69S\O20518.XLS
%HOMEPATH%\Q69S\F58412.JKR
%HOMEPATH%\Q69S\38102.OQK
%HOMEPATH%\Q69S\74144.SPD
%HOMEPATH%\Q69S\20376.YDR
%HOMEPATH%\Q69S\J91414.DDU
%HOMEPATH%\Q69S\98370.QLM
%HOMEPATH%\Q69S\S9798.ALV
%HOMEPATH%\Q69S\95336.QXD
%HOMEPATH%\Q69S\38776.OLG
%HOMEPATH%\Q69S\P49328.GZN
%HOMEPATH%\Q69S\P10373.HVT
%HOMEPATH%\Q69S\T19600.IIZ
%HOMEPATH%\Q69S\T53395.PNK
%HOMEPATH%\Q69S\76761.SEK
%HOMEPATH%\Q69S\S98766.VMN
%HOMEPATH%\Q69S\U70121.VFT
%HOMEPATH%\Q69S\72027.TNT
%HOMEPATH%\Q69S\P7219.TZX
%HOMEPATH%\Q69S\94856.ISR
%HOMEPATH%\Q69S\24616.JHN
%HOMEPATH%\Q69S\I58067.NSG
%HOMEPATH%\Q69S\Y19064.MWZ
%HOMEPATH%\Q69S\21524.OKG
%HOMEPATH%\Q69S\N26821.STI
%HOMEPATH%\Q69S\O81503.DLF
%HOMEPATH%\Q69S\H80042.LGY
%HOMEPATH%\Q69S\74613.NVS
%HOMEPATH%\Q69S\87956.SII
%HOMEPATH%\Q69S\18519.FMF
%HOMEPATH%\Q69S\Q14198.CXC
%HOMEPATH%\Q69S\2428.BSK
%HOMEPATH%\Q69S\F37455.EWC
%HOMEPATH%\Q69S\L14130.TUN
%HOMEPATH%\Q69S\I36753.SMA
%HOMEPATH%\Q69S\58169.HHT
%HOMEPATH%\Q69S\H94411.JAJ
%HOMEPATH%\Q69S\W10154.BWT
%HOMEPATH%\Q69S\71602.ZZW
%HOMEPATH%\Q69S\28974.XMY
%APPDATA%\system\miner.dll
%APPDATA%\system\coinutil.dll
%APPDATA%\system\openssl.dll
%APPDATA%\system\mpir.dll
%APPDATA%\system\displayr.exe
%HOMEPATH%\Q69S\Y8887.SQI
%HOMEPATH%\Q69S\96498.VUA
%HOMEPATH%\Q30J35.JF3
%TEMP%\aut1.tmp
%HOMEPATH%\Q69S\95688.GDS
%HOMEPATH%\Q69S\G47249.FMK
%HOMEPATH%\Q69S\83325.FVY
%HOMEPATH%\Q69S\O13527.ZXB
%HOMEPATH%\Q69S\E84713.CDI
%HOMEPATH%\Q69S\S90515.TSR
%HOMEPATH%\Q69S\M10493.ARD
%HOMEPATH%\Q69S\C21703.IOB
%HOMEPATH%\Q69S\A89261.RVM
%HOMEPATH%\Q69S\60524.BMQ
%HOMEPATH%\Q69S\80207.XQS
%HOMEPATH%\Q69S\P32708.USU
%HOMEPATH%\Q69S\W54707.URK
%HOMEPATH%\Q69S\67311.NAK
%HOMEPATH%\Q69S\K21984.CXR
%HOMEPATH%\Q69S\Z6436.FHP
%HOMEPATH%\Q69S\T78734.DJW
%HOMEPATH%\Q69S\V11499.KDP
%HOMEPATH%\Q69S\X94739.URQ
%HOMEPATH%\Q69S\25006.KYN
%HOMEPATH%\Q69S\28272.EKR
%HOMEPATH%\Q69S\K12972.NAL
%HOMEPATH%\Q69S\25525.SUK
%HOMEPATH%\Q69S\Z71775.JTU
%HOMEPATH%\Q69S\35437.TOH
%HOMEPATH%\Q69S\N94472.TEG
%HOMEPATH%\Q69S\96350.PNT
%HOMEPATH%\Q69S\Q73681.NJW
%HOMEPATH%\Q69S\M58226.RMV
%HOMEPATH%\Q69S\H9110.KJP
%HOMEPATH%\Q69S\U24355.SPX
%HOMEPATH%\Q69S\C27953.AVS
%HOMEPATH%\Q69S\6242.UBT
%HOMEPATH%\Q69S\57012.ADN
%HOMEPATH%\Q69S\11807.XBU
%HOMEPATH%\Q69S\46291.JVY
%HOMEPATH%\Q69S\7201.EFG
%HOMEPATH%\Q69S\90990.PMK
%HOMEPATH%\Q69S\J90771.PQV
%HOMEPATH%\Q69S\9929.BKV
%HOMEPATH%\Q69S\E60520.GZY
%HOMEPATH%\Q69S\P77646.OYF
%HOMEPATH%\Q69S\T63073.BEJ
%HOMEPATH%\Q69S\J61268.MVU
%HOMEPATH%\Q69S\33591.LDQ
%HOMEPATH%\Q69S\Z18726.HVN
%HOMEPATH%\Q69S\30874.SHO
%HOMEPATH%\Q69S\79984.AZK
%HOMEPATH%\Q69S\94914.PXC
%HOMEPATH%\Q69S\71813.XLN
%HOMEPATH%\Q69S\X91041.BGH
%HOMEPATH%\Q69S\G62226.UWS
%HOMEPATH%\Q69S\5130.WCY
%HOMEPATH%\Q69S\J86634.PKI
%HOMEPATH%\Q69S\87713.YBR
%HOMEPATH%\Q69S\17881.OPH
%HOMEPATH%\Q69S\98526.UHO
%HOMEPATH%\Q69S\35187.EBC
%HOMEPATH%\Q69S\2610.UJP
%HOMEPATH%\Q69S\60422.UPH
%HOMEPATH%\Q69S\72312.KSG
%HOMEPATH%\Q69S\93733.RKA
%HOMEPATH%\Q69S\75695.FFN
%HOMEPATH%\Q69S\D31027.EGN
%HOMEPATH%\Q69S\T91213.EHV
%HOMEPATH%\Q69S\78181.COH
%HOMEPATH%\Q69S\67202.MSK
%HOMEPATH%\Q69S\L81410.KHD
%HOMEPATH%\Q69S\E98276.XDO
%HOMEPATH%\Q69S\D16883.ERC
%HOMEPATH%\Q69S\22289.XIM
%HOMEPATH%\Q69S\C58598.HOQ
%HOMEPATH%\Q69S\O98854.HAX
%HOMEPATH%\Q69S\O75901.CSR
%HOMEPATH%\Q69S\T49636.ZAT
%HOMEPATH%\Q69S\95207.TOC
%HOMEPATH%\Q69S\48727.UUC
%HOMEPATH%\Q69S\Q90616.AKD
%HOMEPATH%\Q69S\15229.THV
%HOMEPATH%\Q69S\I99365.OFH
%HOMEPATH%\Q69S\E98737.WVE
%HOMEPATH%\Q69S\Q99607.WNP
%HOMEPATH%\Q69S\U29112.RWZ
%HOMEPATH%\Q69S\B35798.SXI
%HOMEPATH%\Q69S\F98396.JTP
%HOMEPATH%\Q69S\68772.JPI
%HOMEPATH%\Q69S\24628.PVL
%HOMEPATH%\Q69S\M33698.SZJ
%HOMEPATH%\Q69S\64729.SZR
%HOMEPATH%\Q69S\B30463.BUM
%HOMEPATH%\Q69S\Z96021.GHQ
%HOMEPATH%\Q69S\A85121.XHW
%HOMEPATH%\Q69S\N44633.XAQ
%HOMEPATH%\Q69S\51928.ZBM
%HOMEPATH%\Q69S\Y11492.AKE
%HOMEPATH%\Q69S\W23118.HPY
%HOMEPATH%\Q69S\A9223.HPA
%HOMEPATH%\Q69S\20240.NSA
%HOMEPATH%\Q69S\67561.EQT
%HOMEPATH%\Q69S\96194.AEJ
%HOMEPATH%\Q69S\M91331.VPK
%HOMEPATH%\Q69S\A39836.LFM
%HOMEPATH%\Q69S\44480.TNF
%HOMEPATH%\Q69S\S96183.VEA
%HOMEPATH%\Q69S\I40404.UEH
%HOMEPATH%\Q69S\70594.IFF
%HOMEPATH%\Q69S\40244.GDK
%HOMEPATH%\Q69S\85071.WDY
%HOMEPATH%\Q69S\68432.WPJ
%HOMEPATH%\Q69S\J36619.XEX
%HOMEPATH%\Q69S\52263.JLV
%HOMEPATH%\Q69S\6291.HMK
%HOMEPATH%\Q69S\B17831.OJE
%HOMEPATH%\Q69S\W13602.KLA
%HOMEPATH%\Q69S\Y37821.TIO
%HOMEPATH%\Q69S\Z10588.BXL
%HOMEPATH%\Q69S\15642.VSQ
%HOMEPATH%\Q69S\Y36330.TQL
%HOMEPATH%\Q69S\32845.PLB
%HOMEPATH%\Q69S\94853.MNQ
%HOMEPATH%\Q69S\67297.LNV
%HOMEPATH%\Q69S\C91348.VAS
%HOMEPATH%\Q69S\89686.GTA
%HOMEPATH%\Q69S\83465.BJR
%HOMEPATH%\Q69S\38606.KIU
%HOMEPATH%\Q69S\L30053.AVB
%HOMEPATH%\Q69S\27389.MPR
%HOMEPATH%\Q69S\O68872.MSB
%HOMEPATH%\Q69S\U6617.CPK
%HOMEPATH%\Q69S\62004.HYJ
%HOMEPATH%\Q69S\R97931.JJN
%HOMEPATH%\Q69S\73289.YCJ
%HOMEPATH%\Q69S\E31163.NUR
%HOMEPATH%\Q69S\31808.HOC
%HOMEPATH%\Q69S\U57861.UNL
%HOMEPATH%\Q69S\65015.VRX
%HOMEPATH%\Q69S\47143.MMJ
%HOMEPATH%\Q69S\K47303.OHR
%HOMEPATH%\Q69S\D92178.QQC
%HOMEPATH%\Q69S\M84711.RDQ
%HOMEPATH%\Q69S\J91344.ASN
%HOMEPATH%\Q69S\28315.BQO
%HOMEPATH%\Q69S\55862.FSD
%HOMEPATH%\Q69S\55239.ELD
%HOMEPATH%\Q69S\49096.UJO
%HOMEPATH%\Q69S\33811.FDQ
%HOMEPATH%\Q69S\95818.YCT
%HOMEPATH%\Q69S\52699.QBN
%HOMEPATH%\Q69S\26633.ISH
%HOMEPATH%\Q69S\I29606.IQD
%HOMEPATH%\Q69S\75591.ENW
%HOMEPATH%\Q69S\1812.BMQ
%HOMEPATH%\Q69S\43177.VOM
%HOMEPATH%\Q69S\45840.XUJ
%HOMEPATH%\Q69S\79100.JES
%HOMEPATH%\Q69S\4525.DOG
%HOMEPATH%\Q69S\B8144.YQS
%HOMEPATH%\Q69S\44557.JPH
%HOMEPATH%\Q69S\24799.SYN
%HOMEPATH%\Q69S\63206.IYY
%HOMEPATH%\Q69S\54895.HKG
%HOMEPATH%\Q69S\87212.HZM
%HOMEPATH%\Q69S\S2357.QQZ
%HOMEPATH%\Q69S\X99562.FMV
%HOMEPATH%\Q69S\9165.PBY
%HOMEPATH%\Q69S\H17492.PIX
%HOMEPATH%\Q69S\Q77105.VFP
%HOMEPATH%\Q69S\H21881.RSX
%HOMEPATH%\Q69S\M56643.QNC
%HOMEPATH%\Q69S\93004.DMX
%HOMEPATH%\Q69S\U16782.XCF
%HOMEPATH%\Q69S\Z39213.TSM
%HOMEPATH%\Q69S\2138.EQQ
%HOMEPATH%\Q69S\Y51893.LLS
%HOMEPATH%\Q69S\76466.CAM
%HOMEPATH%\Q69S\85251.HQD
%HOMEPATH%\Q69S\58161.VHZ
%HOMEPATH%\Q69S\21695.XHP
%HOMEPATH%\Q69S\90850.QEJ
%HOMEPATH%\Q69S\56895.BHU
%HOMEPATH%\Q69S\47695.YWL
%HOMEPATH%\Q69S\26195.QPY
%HOMEPATH%\Q69S\97804.KBZ
%HOMEPATH%\Q69S\P30327.SWS
%HOMEPATH%\Q69S\V83688.ZLB
%HOMEPATH%\Q69S\50185.AIJ
%HOMEPATH%\Q69S\66186.FQY
%HOMEPATH%\Q69S\49252.IVH
%HOMEPATH%\Q69S\75454.KDM
%HOMEPATH%\Q69S\61956.ISN
%HOMEPATH%\Q69S\46467.AZE
%HOMEPATH%\Q69S\ikv.exe
%HOMEPATH%\Q69S\28355.XUJ
%HOMEPATH%\Q69S\Q19409.XJH
%HOMEPATH%\Q69S\59455.SUO
%HOMEPATH%\Q69S\Y64133.RBQ
%HOMEPATH%\Q69S\4318.VDT
%HOMEPATH%\Q69S\S12185.BAO
%HOMEPATH%\Q69S\G10749.LVR
%HOMEPATH%\Q69S\39612.CYI
%HOMEPATH%\Q69S\E95862.OER
%HOMEPATH%\Q69S\M68148.LVR
%HOMEPATH%\Q69S\55710.WKY
%HOMEPATH%\Q69S\W20025.CLK
%HOMEPATH%\Q69S\64479.FQT
%HOMEPATH%\Q69S\X53882.THE
%HOMEPATH%\Q69S\44137.OWS
%HOMEPATH%\Q69S\9121.VTK
%HOMEPATH%\Q69S\L60908.EUH
%HOMEPATH%\Q69S\5093.RCL
%HOMEPATH%\Q69S\21075.IOZ
%HOMEPATH%\Q69S\94627.BLS
%HOMEPATH%\Q69S\L95909.FBW
%HOMEPATH%\Q69S\Y5118.LQT
%HOMEPATH%\Q69S\25928.ABV
%HOMEPATH%\Q69S\S83319.TAQ
%HOMEPATH%\Q69S\37054.ZGG
%HOMEPATH%\Q69S\72721.OXW
%HOMEPATH%\Q69S\31459.GTP
%HOMEPATH%\Q69S\H17049.PLM
%HOMEPATH%\Q69S\94494.NAA
%HOMEPATH%\Q69S\C46710.LGH
%HOMEPATH%\Q69S\J43576.MIY
%HOMEPATH%\Q69S\F64165.QLX
%HOMEPATH%\Q69S\D95137.LUB
%HOMEPATH%\Q69S\37875.LGH
%HOMEPATH%\Q69S\R31636.XED
%HOMEPATH%\Q69S\C70989.NSU
%HOMEPATH%\Q69S\27723.AEN
%HOMEPATH%\Q69S\X10226.FCW
%HOMEPATH%\Q69S\17042.DYV
%HOMEPATH%\Q69S\33920.BXJ
%HOMEPATH%\Q69S\39239.ZRQ
%HOMEPATH%\Q69S\60480.XKD
%HOMEPATH%\Q69S\96065.PBY
%HOMEPATH%\Q69S\42857.OIJ
%HOMEPATH%\Q69S\R68066.IHE
%HOMEPATH%\Q69S\O30278.WGW
%HOMEPATH%\Q69S\F33818.AJD
%HOMEPATH%\Q69S\D84866.UJP
%HOMEPATH%\Q69S\E11108.GKF
%HOMEPATH%\Q69S\O52974.AFI
%HOMEPATH%\Q69S\12946.THA
%HOMEPATH%\Q69S\48438.FVQ
%HOMEPATH%\Q69S\75283.JKD
%HOMEPATH%\Q69S\L85832.CYI
%HOMEPATH%\Q69S\21334.BNE
%HOMEPATH%\Q69S\8818.MHX
%HOMEPATH%\Q69S\S47286.JWR
%HOMEPATH%\Q69S\70115.IBM
%HOMEPATH%\Q69S\52694.WZT
%HOMEPATH%\Q69S\K13006.XXF
%HOMEPATH%\Q69S\79917.EZR
%HOMEPATH%\Q69S\D74887.RVS
%HOMEPATH%\Q69S\U90961.UAV
%HOMEPATH%\Q69S\Z52272.MWF
%HOMEPATH%\Q69S\M40244.ACO
%HOMEPATH%\Q69S\E89547.AZL
%HOMEPATH%\Q69S\61318.ALN
%HOMEPATH%\Q69S\S40759.SNJ
%HOMEPATH%\Q69S\81646.KPY
%HOMEPATH%\Q69S\68716.FVK
%HOMEPATH%\Q69S\94230.YBQ
%HOMEPATH%\Q69S\R3712.YTF
%HOMEPATH%\Q69S\X78905.UMC
%HOMEPATH%\Q69S\80739.LSU
%HOMEPATH%\Q69S\I54535.VCO
%HOMEPATH%\Q69S\X36612.BIT
%HOMEPATH%\Q69S\Y12852.XXL
%HOMEPATH%\Q69S\D49458.BWM
%HOMEPATH%\Q69S\21937.NKU
%HOMEPATH%\Q69S\78174.JWY
%HOMEPATH%\Q69S\39021.IMG
%HOMEPATH%\Q69S\62174.WLS
%HOMEPATH%\Q69S\T27026.RRP
%HOMEPATH%\Q69S\88607.ZPY
%HOMEPATH%\Q69S\58529.RBL
%HOMEPATH%\Q69S\D86757.ZCG
%HOMEPATH%\Q69S\X39940.UQE
%HOMEPATH%\Q69S\52776.SSD
%HOMEPATH%\Q69S\73964.IQD
%HOMEPATH%\Q69S\88681.WEX
%HOMEPATH%\Q69S\H25397.SUI
%HOMEPATH%\Q69S\5713.POP
%HOMEPATH%\Q69S\M93665.TKT
%HOMEPATH%\Q69S\M8810.RXF
%HOMEPATH%\Q69S\V39300.DZH
%HOMEPATH%\Q69S\3413.PMM
%HOMEPATH%\Q69S\43255.DIE
%HOMEPATH%\Q69S\23504.OWK
%HOMEPATH%\Q69S\31797.XQW
%HOMEPATH%\Q69S\89786.EYT
%HOMEPATH%\Q69S\64596.VHE
%HOMEPATH%\Q69S\3810.EKU
%HOMEPATH%\Q69S\M61664.UMJ
%HOMEPATH%\Q69S\V64175.RRE
%HOMEPATH%\Q69S\7792.XHS
%HOMEPATH%\Q69S\44147.GGX
%HOMEPATH%\Q69S\D31479.FJM
%HOMEPATH%\Q69S\G30412.DLA
%HOMEPATH%\Q69S\W95493.XPK
%HOMEPATH%\Q69S\96306.SBJ
%HOMEPATH%\Q69S\E55908.WUZ
%HOMEPATH%\Q69S\G64559.UNA
%HOMEPATH%\Q69S\A77031.DNN
%HOMEPATH%\Q69S\I69837.QTE
%HOMEPATH%\Q69S\X6400.MZC
%HOMEPATH%\Q69S\6644.JXH
%HOMEPATH%\Q69S\O62874.FNW
%HOMEPATH%\Q69S\E51632.RIH
%HOMEPATH%\Q69S\10316.FMP
%HOMEPATH%\Q69S\73388.DUO
%HOMEPATH%\Q69S\S87916.ZTI
%HOMEPATH%\Q69S\2648.UAS
%HOMEPATH%\Q69S\23782.CMW
%HOMEPATH%\Q69S\P16924.PZV
%HOMEPATH%\Q69S\X63260.FHJ
%HOMEPATH%\Q69S\61101.HIO
%HOMEPATH%\Q69S\85311.USI
%HOMEPATH%\Q69S\Z72801.PVU
%HOMEPATH%\Q69S\H57564.DAE
%HOMEPATH%\Q69S\U94204.RNO
%HOMEPATH%\Q69S\Y6595.VFH
%HOMEPATH%\Q69S\J62803.FCH
%HOMEPATH%\Q69S\81956.ZCM
%HOMEPATH%\Q69S\37721.SRN
%HOMEPATH%\Q69S\H34161.GIT
%HOMEPATH%\Q69S\R89533.NUQ
%HOMEPATH%\Q69S\T88031.SVY
%HOMEPATH%\Q69S\N62246.LZJ
%HOMEPATH%\Q69S\I44263.MXQ
%HOMEPATH%\Q69S\D85347.ZNY
%HOMEPATH%\Q69S\21675.OMN
%HOMEPATH%\Q69S\92423.VMA
%HOMEPATH%\Q69S\24048.FQJ
%HOMEPATH%\Q69S\F17539.KAV
%HOMEPATH%\Q69S\G50723.ZPZ
%HOMEPATH%\Q69S\T84386.TVK
%HOMEPATH%\Q69S\58717.VKL
%HOMEPATH%\Q69S\A61101.KPR
%HOMEPATH%\Q69S\53223.XWB
%HOMEPATH%\Q69S\T65428.TCU
%HOMEPATH%\Q69S\L98245.VJF
%HOMEPATH%\Q69S\41414.GMN
%HOMEPATH%\Q69S\M51256.XJB
%HOMEPATH%\Q69S\3003.QBL
%HOMEPATH%\Q69S\30779.JUS
%HOMEPATH%\Q69S\D94032.HWN
%HOMEPATH%\Q69S\Y84822.UDL
%HOMEPATH%\Q69S\30179.HRC
%HOMEPATH%\Q69S\V53180.MTP
%HOMEPATH%\Q69S\W62647.KHQ
%HOMEPATH%\Q69S\20435.VZU
%HOMEPATH%\Q69S\J19679.PKT
%HOMEPATH%\Q69S\71826.IFV
%HOMEPATH%\Q69S\W48263.NIO
%HOMEPATH%\Q69S\67185.BAZ
%HOMEPATH%\Q69S\C3756.PAD
%HOMEPATH%\Q69S\P58031.FGH
%HOMEPATH%\Q69S\K47727.RKN
%HOMEPATH%\Q69S\O38119.HMX
%HOMEPATH%\Q69S\90591.FPV
%HOMEPATH%\Q69S\T16837.TQP
%HOMEPATH%\Q69S\30442.RWK
%HOMEPATH%\Q69S\26915.VSA
%HOMEPATH%\Q69S\F82497.NMM
%HOMEPATH%\Q69S\69852.MLN
%HOMEPATH%\Q69S\I19027.EFF
%HOMEPATH%\Q69S\I22275.NZM
%HOMEPATH%\Q69S\71107.CYS
%HOMEPATH%\Q69S\66761.BEG
%HOMEPATH%\Q69S\8833.LBG
%HOMEPATH%\Q69S\70182.DEM
%HOMEPATH%\Q69S\N58615.LMW
%HOMEPATH%\Q69S\R55937.ZAD
%HOMEPATH%\Q69S\E32375.YRC
%HOMEPATH%\Q69S\L82605.VVV
%HOMEPATH%\Q69S\98003.SPF
%HOMEPATH%\Q69S\90150.ZOT
%HOMEPATH%\Q69S\77984.EHM
%HOMEPATH%\Q69S\M72449.FOP
%HOMEPATH%\Q69S\21294.YRE
%HOMEPATH%\Q69S\C33120.ERO
%HOMEPATH%\Q69S\M60862.ORD
%HOMEPATH%\Q69S\47907.ZPC
%HOMEPATH%\Q69S\H9468.VIH
%HOMEPATH%\Q69S\Z75186.ALV

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\Q30J35.JF3

Deletes the following files:

%HOMEPATH%\Q30J35.JF3
%TEMP%\aut1.tmp

Moves the following system files:

from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe to %APPDATA%\system\drivers.exe

Network activity:

Connects to:

'19#.#0.57.179':80
'wp#d':80

TCP:

HTTP GET requests:

19#.#0.57.179/sov_9292/miner.dll
19#.#0.57.179/sov_9292/mpir.dll
19#.#0.57.179/sov_9292/openssl.dll
wp#d/wpad.dat
19#.#0.57.179/sov_9292/coin-miner.exe
19#.#0.57.179/sov_9292/coinutil.dll

UDP:

DNS ASK wp#d

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial