Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'
- hidden files
- file extensions
- User Account Control (UAC)
- '%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
- '%TEMP%\vcredist_x86.exe'
- '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'
- '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- C:\RCX4B.tmp
- <Current directory>\FwkE.ico
- <Current directory>\UQEw.exe
- C:\RCX4A.tmp
- <Current directory>\NWYU.ico
- <Current directory>\cMYk.exe
- C:\RCX4D.tmp
- <Current directory>\eago.ico
- <Current directory>\jcIo.exe
- C:\RCX4C.tmp
- <Current directory>\JOok.ico
- <Current directory>\tako.ico
- <Current directory>\QwIi.exe
- C:\RCX47.tmp
- <Current directory>\wccU.ico
- <Current directory>\cEkW.exe
- C:\RCX48.tmp
- <Current directory>\BKsE.ico
- <Current directory>\IgwS.exe
- C:\RCX49.tmp
- <Current directory>\PEQY.ico
- <Current directory>\QEkQ.exe
- <Current directory>\ggws.ico
- <Current directory>\UkMI.exe
- C:\RCX52.tmp
- <Current directory>\TYIE.ico
- <Current directory>\LgQa.exe
- C:\RCX53.tmp
- <Current directory>\cCAg.ico
- <Current directory>\BkwK.exe
- C:\RCX54.tmp
- <Current directory>\aYoU.ico
- <Current directory>\sMwc.exe
- <Current directory>\Pwca.exe
- C:\RCX4F.tmp
- <Current directory>\VgcY.ico
- <Current directory>\ZYsK.exe
- C:\RCX4E.tmp
- <Current directory>\gksM.ico
- <Current directory>\ywAg.exe
- C:\RCX51.tmp
- <Current directory>\ciIU.ico
- <Current directory>\LQEi.exe
- C:\RCX50.tmp
- C:\RCX46.tmp
- C:\RCX3C.tmp
- <Current directory>\viYw.ico
- <Current directory>\Wcou.exe
- C:\RCX3B.tmp
- <Current directory>\ooAw.ico
- <Current directory>\qQow.exe
- C:\RCX3E.tmp
- <Current directory>\HGEA.ico
- <Current directory>\gwoo.exe
- C:\RCX3D.tmp
- <Current directory>\JcEs.ico
- <Current directory>\tSsM.ico
- <Current directory>\kEEQ.exe
- C:\RCX38.tmp
- <Current directory>\aCUA.ico
- <Current directory>\aMYa.exe
- C:\RCX39.tmp
- <Current directory>\SKMc.ico
- <Current directory>\IEos.exe
- C:\RCX3A.tmp
- <Current directory>\QKUM.ico
- <Current directory>\MMQm.exe
- <Current directory>\sGko.ico
- <Current directory>\rAIU.exe
- C:\RCX43.tmp
- <Current directory>\FoQE.ico
- <Current directory>\WYMK.exe
- C:\RCX44.tmp
- <Current directory>\eQoY.ico
- <Current directory>\BIEo.exe
- C:\RCX45.tmp
- <Current directory>\DYsQ.ico
- <Current directory>\sAku.exe
- <Current directory>\Posw.exe
- C:\RCX40.tmp
- <Current directory>\JaII.ico
- <Current directory>\hcYS.exe
- C:\RCX3F.tmp
- <Current directory>\cEQs.ico
- <Current directory>\rIMG.exe
- C:\RCX42.tmp
- <Current directory>\AEoE.ico
- <Current directory>\Lsoa.exe
- C:\RCX41.tmp
- <Current directory>\OkYA.exe
- C:\RCX69.tmp
- <Current directory>\fYQU.ico
- <Current directory>\wkgc.exe
- C:\RCX68.tmp
- <Current directory>\MCsM.ico
- <Current directory>\uYsi.exe
- C:\RCX6B.tmp
- <Current directory>\bIcQ.ico
- <Current directory>\QIcI.exe
- C:\RCX6A.tmp
- C:\RCX65.tmp
- <Current directory>\vWQc.ico
- <Current directory>\DwsU.exe
- C:\RCX64.tmp
- <Current directory>\NOkc.ico
- <Current directory>\EcMM.exe
- C:\RCX67.tmp
- <Current directory>\Ymcw.ico
- <Current directory>\lUYw.exe
- C:\RCX66.tmp
- <Current directory>\FeQA.ico
- C:\RCX70.tmp
- <Current directory>\ciIE.ico
- <Current directory>\bwow.exe
- C:\RCX6F.tmp
- <Current directory>\EssI.ico
- <Current directory>\yIMO.exe
- C:\RCX72.tmp
- <Current directory>\WGkc.ico
- <Current directory>\dwsk.exe
- C:\RCX71.tmp
- <Current directory>\PiAk.ico
- <Current directory>\ocUc.ico
- <Current directory>\Jwku.exe
- C:\RCX6C.tmp
- <Current directory>\ZoME.ico
- <Current directory>\BwEc.exe
- C:\RCX6D.tmp
- <Current directory>\pisU.ico
- <Current directory>\TkIk.exe
- C:\RCX6E.tmp
- <Current directory>\MssU.ico
- <Current directory>\pIEm.exe
- <Current directory>\voYW.exe
- <Current directory>\pcwy.exe
- C:\RCX5A.tmp
- <Current directory>\wGEU.ico
- <Current directory>\KsUc.exe
- C:\RCX59.tmp
- <Current directory>\FwIc.ico
- <Current directory>\SQUI.exe
- C:\RCX5C.tmp
- <Current directory>\WIkQ.ico
- <Current directory>\lcQS.exe
- C:\RCX5B.tmp
- C:\RCX56.tmp
- <Current directory>\EgEc.ico
- <Current directory>\HYYK.exe
- C:\RCX55.tmp
- <Current directory>\cmoo.ico
- <Current directory>\lIcQ.exe
- C:\RCX58.tmp
- <Current directory>\jiUM.ico
- <Current directory>\YggG.exe
- C:\RCX57.tmp
- <Current directory>\HKwU.ico
- C:\RCX61.tmp
- <Current directory>\Aqwc.ico
- <Current directory>\YQIo.exe
- C:\RCX60.tmp
- <Current directory>\GQQg.ico
- <Current directory>\wgMY.exe
- C:\RCX63.tmp
- <Current directory>\LYYk.ico
- <Current directory>\swcg.exe
- C:\RCX62.tmp
- <Current directory>\BAoM.ico
- <Current directory>\OAQo.ico
- <Current directory>\iwsk.exe
- C:\RCX5D.tmp
- <Current directory>\jYwk.ico
- <Current directory>\ecQG.exe
- C:\RCX5E.tmp
- <Current directory>\LCAs.ico
- <Current directory>\cYYc.exe
- C:\RCX5F.tmp
- <Current directory>\QIoY.ico
- <Current directory>\tAIm.exe
- C:\RCX37.tmp
- <Current directory>\juYM.ico
- <Current directory>\GAcS.exe
- C:\RCXF.tmp
- <Current directory>\jCIA.ico
- <Current directory>\JksO.exe
- C:\RCX10.tmp
- <Current directory>\fmUg.ico
- <Current directory>\NAkI.exe
- C:\RCX11.tmp
- <Current directory>\mMwc.ico
- <Current directory>\bEYe.exe
- <Current directory>\DcwI.exe
- C:\RCXC.tmp
- <Current directory>\JKow.ico
- <Current directory>\HMMU.exe
- C:\RCXB.tmp
- <Current directory>\eMAg.ico
- <Current directory>\bkAO.exe
- C:\RCXE.tmp
- <Current directory>\rsso.ico
- <Current directory>\SEEe.exe
- C:\RCXD.tmp
- <Current directory>\AgAi.exe
- C:\RCX17.tmp
- <Current directory>\eqIk.ico
- <Current directory>\IAEe.exe
- C:\RCX16.tmp
- <Current directory>\xusY.ico
- <Current directory>\ncsS.exe
- C:\RCX19.tmp
- <Current directory>\YaoI.ico
- <Current directory>\wEwu.exe
- C:\RCX18.tmp
- C:\RCX13.tmp
- <Current directory>\BEQk.ico
- <Current directory>\skIG.exe
- C:\RCX12.tmp
- <Current directory>\xQkw.ico
- <Current directory>\FgYu.exe
- C:\RCX15.tmp
- <Current directory>\RqYI.ico
- <Current directory>\iQoU.exe
- C:\RCX14.tmp
- <Current directory>\foAM.ico
- <Current directory>\cwck.ico
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\license.rtf
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\BootstrapperApplicationData.xml
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\logo.png
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.xml
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.wxl
- %TEMP%\dd_vcredist_x86_20140822164702.log
- <Current directory>\lgIo.ico
- <Current directory>\QgsK.exe
- C:\RCX2.tmp
- <Current directory>\FuMg.ico
- <Current directory>\aUoq.exe
- %ALLUSERSPROFILE%\casg.txt
- C:\Documents and Settings\LocalService\NIMMEwsg\jaQEcQMQ
- %ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
- %HOMEPATH%\NIMMEwsg\jaQEcQMQ
- %ALLUSERSPROFILE%\vesswIQA\AcIcUcAM
- %TEMP%\xSoUMscU.bat
- C:\RCX1.tmp
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\wixstdba.dll
- <Current directory>\qwoY.exe
- %TEMP%\vcredist_x86.exe
- <Current directory>\pcQU.ico
- <Current directory>\oQYO.exe
- C:\RCX8.tmp
- <Current directory>\hWoA.ico
- <Current directory>\HEgC.exe
- C:\RCX7.tmp
- <Current directory>\TeUM.ico
- <Current directory>\MsIm.exe
- C:\RCXA.tmp
- <Current directory>\qCUk.ico
- <Current directory>\ncYI.exe
- C:\RCX9.tmp
- C:\RCX4.tmp
- <Current directory>\quoQ.ico
- <Current directory>\MoIC.exe
- C:\RCX3.tmp
- <Current directory>\wsIg.ico
- <Current directory>\fkII.exe
- C:\RCX6.tmp
- <Current directory>\qmsE.ico
- <Current directory>\SYYa.exe
- C:\RCX5.tmp
- <Current directory>\sMck.ico
- C:\RCX2D.tmp
- <Current directory>\NMok.ico
- <Current directory>\hwAy.exe
- C:\RCX2C.tmp
- <Current directory>\Gwss.ico
- <Current directory>\uoUo.exe
- C:\RCX2F.tmp
- <Current directory>\ocEA.ico
- <Current directory>\iEYG.exe
- C:\RCX2E.tmp
- <Current directory>\ruoU.ico
- <Current directory>\TIoE.ico
- <Current directory>\FMsQ.exe
- C:\RCX29.tmp
- <Current directory>\fKQw.ico
- <Current directory>\bEIw.exe
- C:\RCX2A.tmp
- <Current directory>\QQMA.ico
- <Current directory>\qQAC.exe
- C:\RCX2B.tmp
- <Current directory>\PEEQ.ico
- <Current directory>\dIQi.exe
- <Current directory>\LkkQ.ico
- <Current directory>\gkkO.exe
- C:\RCX34.tmp
- <Current directory>\gyAA.ico
- <Current directory>\Hsgu.exe
- C:\RCX35.tmp
- <Current directory>\egAg.ico
- <Current directory>\ZIwA.exe
- C:\RCX36.tmp
- <Current directory>\jQAI.ico
- <Current directory>\AAEs.exe
- <Current directory>\ukEC.exe
- C:\RCX31.tmp
- <Current directory>\gKQQ.ico
- <Current directory>\Vgwo.exe
- C:\RCX30.tmp
- <Current directory>\bQEc.ico
- <Current directory>\uwEk.exe
- C:\RCX33.tmp
- <Current directory>\SiUE.ico
- <Current directory>\YoEu.exe
- C:\RCX32.tmp
- C:\RCX28.tmp
- C:\RCX1E.tmp
- <Current directory>\wGgo.ico
- <Current directory>\HIsG.exe
- C:\RCX1D.tmp
- <Current directory>\Ewcg.ico
- <Current directory>\ncck.exe
- C:\RCX20.tmp
- <Current directory>\mmIY.ico
- <Current directory>\qgoc.exe
- C:\RCX1F.tmp
- <Current directory>\qUcA.ico
- <Current directory>\dgQs.ico
- <Current directory>\iEgm.exe
- C:\RCX1A.tmp
- <Current directory>\eygM.ico
- <Current directory>\dMgS.exe
- C:\RCX1B.tmp
- <Current directory>\Vuko.ico
- <Current directory>\XIAK.exe
- C:\RCX1C.tmp
- <Current directory>\IOQY.ico
- <Current directory>\loEE.exe
- <Current directory>\wgMo.ico
- <Current directory>\aQYo.exe
- C:\RCX25.tmp
- <Current directory>\Jkwg.ico
- <Current directory>\tgga.exe
- C:\RCX26.tmp
- <Current directory>\bGUo.ico
- <Current directory>\UkQm.exe
- C:\RCX27.tmp
- <Current directory>\KycA.ico
- <Current directory>\UggO.exe
- <Current directory>\iAYc.exe
- C:\RCX22.tmp
- <Current directory>\caoY.ico
- <Current directory>\tYgo.exe
- C:\RCX21.tmp
- <Current directory>\qkQk.ico
- <Current directory>\vkky.exe
- C:\RCX24.tmp
- <Current directory>\kSIU.ico
- <Current directory>\hccu.exe
- C:\RCX23.tmp
- <Current directory>\jcIo.exe
- <Current directory>\FwkE.ico
- <Current directory>\cMYk.exe
- <Current directory>\JOok.ico
- <Current directory>\Pwca.exe
- <Current directory>\eago.ico
- <Current directory>\ZYsK.exe
- <Current directory>\PEQY.ico
- <Current directory>\QEkQ.exe
- <Current directory>\tako.ico
- <Current directory>\IgwS.exe
- <Current directory>\NWYU.ico
- <Current directory>\UQEw.exe
- <Current directory>\BKsE.ico
- <Current directory>\sMwc.exe
- <Current directory>\ggws.ico
- <Current directory>\UkMI.exe
- <Current directory>\aYoU.ico
- <Current directory>\HYYK.exe
- <Current directory>\cCAg.ico
- <Current directory>\BkwK.exe
- <Current directory>\gksM.ico
- <Current directory>\LQEi.exe
- <Current directory>\VgcY.ico
- <Current directory>\ywAg.exe
- <Current directory>\TYIE.ico
- <Current directory>\LgQa.exe
- <Current directory>\ciIU.ico
- <Current directory>\QwIi.exe
- <Current directory>\JcEs.ico
- <Current directory>\gwoo.exe
- <Current directory>\viYw.ico
- <Current directory>\hcYS.exe
- <Current directory>\JaII.ico
- <Current directory>\Posw.exe
- <Current directory>\HGEA.ico
- <Current directory>\IEos.exe
- <Current directory>\QKUM.ico
- <Current directory>\MMQm.exe
- <Current directory>\SKMc.ico
- <Current directory>\qQow.exe
- <Current directory>\ooAw.ico
- <Current directory>\Wcou.exe
- <Current directory>\DYsQ.ico
- <Current directory>\sAku.exe
- <Current directory>\sGko.ico
- <Current directory>\BIEo.exe
- <Current directory>\wccU.ico
- <Current directory>\cEkW.exe
- <Current directory>\eQoY.ico
- <Current directory>\rIMG.exe
- <Current directory>\cEQs.ico
- <Current directory>\Lsoa.exe
- <Current directory>\AEoE.ico
- <Current directory>\rAIU.exe
- <Current directory>\FoQE.ico
- <Current directory>\WYMK.exe
- <Current directory>\fYQU.ico
- <Current directory>\OkYA.exe
- <Current directory>\Ymcw.ico
- <Current directory>\QIcI.exe
- <Current directory>\bIcQ.ico
- <Current directory>\uYsi.exe
- <Current directory>\MCsM.ico
- <Current directory>\EcMM.exe
- <Current directory>\NOkc.ico
- <Current directory>\DwsU.exe
- <Current directory>\vWQc.ico
- <Current directory>\wkgc.exe
- <Current directory>\FeQA.ico
- <Current directory>\lUYw.exe
- <Current directory>\EssI.ico
- <Current directory>\bwow.exe
- <Current directory>\pisU.ico
- <Current directory>\yIMO.exe
- <Current directory>\PiAk.ico
- <Current directory>\dwsk.exe
- <Current directory>\ciIE.ico
- <Current directory>\Jwku.exe
- <Current directory>\ZoME.ico
- <Current directory>\BwEc.exe
- <Current directory>\ocUc.ico
- <Current directory>\TkIk.exe
- <Current directory>\MssU.ico
- <Current directory>\pIEm.exe
- <Current directory>\LYYk.ico
- <Current directory>\lcQS.exe
- <Current directory>\wGEU.ico
- <Current directory>\pcwy.exe
- <Current directory>\FwIc.ico
- <Current directory>\ecQG.exe
- <Current directory>\WIkQ.ico
- <Current directory>\SQUI.exe
- <Current directory>\EgEc.ico
- <Current directory>\lIcQ.exe
- <Current directory>\cmoo.ico
- <Current directory>\YggG.exe
- <Current directory>\jiUM.ico
- <Current directory>\KsUc.exe
- <Current directory>\HKwU.ico
- <Current directory>\wgMY.exe
- <Current directory>\GQQg.ico
- <Current directory>\YQIo.exe
- <Current directory>\Aqwc.ico
- <Current directory>\voYW.exe
- <Current directory>\BAoM.ico
- <Current directory>\swcg.exe
- <Current directory>\OAQo.ico
- <Current directory>\iwsk.exe
- <Current directory>\jYwk.ico
- <Current directory>\tAIm.exe
- <Current directory>\LCAs.ico
- <Current directory>\cYYc.exe
- <Current directory>\QIoY.ico
- <Current directory>\tSsM.ico
- <Current directory>\xQkw.ico
- <Current directory>\skIG.exe
- <Current directory>\fmUg.ico
- <Current directory>\FgYu.exe
- <Current directory>\foAM.ico
- <Current directory>\iQoU.exe
- <Current directory>\BEQk.ico
- <Current directory>\GAcS.exe
- <Current directory>\jCIA.ico
- <Current directory>\JksO.exe
- <Current directory>\juYM.ico
- <Current directory>\NAkI.exe
- <Current directory>\mMwc.ico
- <Current directory>\bEYe.exe
- <Current directory>\eygM.ico
- <Current directory>\dMgS.exe
- <Current directory>\YaoI.ico
- <Current directory>\iEgm.exe
- <Current directory>\IOQY.ico
- <Current directory>\loEE.exe
- <Current directory>\dgQs.ico
- <Current directory>\AgAi.exe
- <Current directory>\RqYI.ico
- <Current directory>\IAEe.exe
- <Current directory>\eqIk.ico
- <Current directory>\ncsS.exe
- <Current directory>\xusY.ico
- <Current directory>\wEwu.exe
- <Current directory>\rsso.ico
- <Current directory>\fkII.exe
- <Current directory>\wsIg.ico
- <Current directory>\MoIC.exe
- <Current directory>\quoQ.ico
- <Current directory>\HEgC.exe
- <Current directory>\sMck.ico
- <Current directory>\SYYa.exe
- <Current directory>\pcQU.ico
- <Current directory>\qwoY.exe
- %TEMP%\xSoUMscU.bat
- <Current directory>\aUoq.exe
- <Current directory>\lgIo.ico
- <Current directory>\QgsK.exe
- <Current directory>\FuMg.ico
- <Current directory>\DcwI.exe
- <Current directory>\cwck.ico
- <Current directory>\HMMU.exe
- <Current directory>\JKow.ico
- <Current directory>\bkAO.exe
- <Current directory>\eMAg.ico
- <Current directory>\SEEe.exe
- <Current directory>\hWoA.ico
- <Current directory>\oQYO.exe
- <Current directory>\qmsE.ico
- <Current directory>\ncYI.exe
- <Current directory>\qCUk.ico
- <Current directory>\MsIm.exe
- <Current directory>\TeUM.ico
- <Current directory>\Vgwo.exe
- <Current directory>\ruoU.ico
- <Current directory>\iEYG.exe
- <Current directory>\ocEA.ico
- <Current directory>\YoEu.exe
- <Current directory>\gKQQ.ico
- <Current directory>\ukEC.exe
- <Current directory>\QQMA.ico
- <Current directory>\qQAC.exe
- <Current directory>\PEEQ.ico
- <Current directory>\hwAy.exe
- <Current directory>\NMok.ico
- <Current directory>\uoUo.exe
- <Current directory>\Gwss.ico
- <Current directory>\ZIwA.exe
- <Current directory>\jQAI.ico
- <Current directory>\AAEs.exe
- <Current directory>\egAg.ico
- <Current directory>\kEEQ.exe
- <Current directory>\aCUA.ico
- <Current directory>\aMYa.exe
- <Current directory>\SiUE.ico
- <Current directory>\uwEk.exe
- <Current directory>\bQEc.ico
- <Current directory>\Hsgu.exe
- <Current directory>\LkkQ.ico
- <Current directory>\gkkO.exe
- <Current directory>\gyAA.ico
- <Current directory>\dIQi.exe
- <Current directory>\mmIY.ico
- <Current directory>\tYgo.exe
- <Current directory>\qUcA.ico
- <Current directory>\iAYc.exe
- <Current directory>\qkQk.ico
- <Current directory>\hccu.exe
- <Current directory>\caoY.ico
- <Current directory>\HIsG.exe
- <Current directory>\Vuko.ico
- <Current directory>\XIAK.exe
- <Current directory>\Ewcg.ico
- <Current directory>\qgoc.exe
- <Current directory>\wGgo.ico
- <Current directory>\ncck.exe
- <Current directory>\bGUo.ico
- <Current directory>\UkQm.exe
- <Current directory>\KycA.ico
- <Current directory>\bEIw.exe
- <Current directory>\TIoE.ico
- <Current directory>\FMsQ.exe
- <Current directory>\fKQw.ico
- <Current directory>\tgga.exe
- <Current directory>\kSIU.ico
- <Current directory>\vkky.exe
- <Current directory>\Jkwg.ico
- <Current directory>\UggO.exe
- <Current directory>\wgMo.ico
- <Current directory>\aQYo.exe
- from C:\RCX4C.tmp to <Current directory>\cMYk.exe
- from C:\RCX4D.tmp to <Current directory>\jcIo.exe
- from C:\RCX4E.tmp to <Current directory>\ZYsK.exe
- from C:\RCX4B.tmp to <Current directory>\UQEw.exe
- from C:\RCX48.tmp to <Current directory>\QwIi.exe
- from C:\RCX49.tmp to <Current directory>\QEkQ.exe
- from C:\RCX4A.tmp to <Current directory>\IgwS.exe
- from C:\RCX53.tmp to <Current directory>\UkMI.exe
- from C:\RCX54.tmp to <Current directory>\sMwc.exe
- from C:\RCX55.tmp to <Current directory>\BkwK.exe
- from C:\RCX52.tmp to <Current directory>\LgQa.exe
- from C:\RCX4F.tmp to <Current directory>\Pwca.exe
- from C:\RCX50.tmp to <Current directory>\LQEi.exe
- from C:\RCX51.tmp to <Current directory>\ywAg.exe
- from C:\RCX3E.tmp to <Current directory>\gwoo.exe
- from C:\RCX3F.tmp to <Current directory>\hcYS.exe
- from C:\RCX40.tmp to <Current directory>\Posw.exe
- from C:\RCX3D.tmp to <Current directory>\qQow.exe
- from C:\RCX3A.tmp to <Current directory>\MMQm.exe
- from C:\RCX3B.tmp to <Current directory>\IEos.exe
- from C:\RCX3C.tmp to <Current directory>\Wcou.exe
- from C:\RCX45.tmp to <Current directory>\sAku.exe
- from C:\RCX46.tmp to <Current directory>\BIEo.exe
- from C:\RCX47.tmp to <Current directory>\cEkW.exe
- from C:\RCX44.tmp to <Current directory>\rAIU.exe
- from C:\RCX41.tmp to <Current directory>\Lsoa.exe
- from C:\RCX42.tmp to <Current directory>\rIMG.exe
- from C:\RCX43.tmp to <Current directory>\WYMK.exe
- from C:\RCX56.tmp to <Current directory>\HYYK.exe
- from C:\RCX69.tmp to <Current directory>\OkYA.exe
- from C:\RCX6A.tmp to <Current directory>\QIcI.exe
- from C:\RCX6B.tmp to <Current directory>\uYsi.exe
- from C:\RCX68.tmp to <Current directory>\wkgc.exe
- from C:\RCX65.tmp to <Current directory>\DwsU.exe
- from C:\RCX66.tmp to <Current directory>\EcMM.exe
- from C:\RCX67.tmp to <Current directory>\lUYw.exe
- from C:\RCX70.tmp to <Current directory>\bwow.exe
- from C:\RCX71.tmp to <Current directory>\yIMO.exe
- from C:\RCX72.tmp to <Current directory>\dwsk.exe
- from C:\RCX6F.tmp to <Current directory>\TkIk.exe
- from C:\RCX6C.tmp to <Current directory>\BwEc.exe
- from C:\RCX6D.tmp to <Current directory>\Jwku.exe
- from C:\RCX6E.tmp to <Current directory>\pIEm.exe
- from C:\RCX5B.tmp to <Current directory>\lcQS.exe
- from C:\RCX5C.tmp to <Current directory>\SQUI.exe
- from C:\RCX5D.tmp to <Current directory>\ecQG.exe
- from C:\RCX5A.tmp to <Current directory>\pcwy.exe
- from C:\RCX57.tmp to <Current directory>\lIcQ.exe
- from C:\RCX58.tmp to <Current directory>\YggG.exe
- from C:\RCX59.tmp to <Current directory>\KsUc.exe
- from C:\RCX62.tmp to <Current directory>\wgMY.exe
- from C:\RCX63.tmp to <Current directory>\swcg.exe
- from C:\RCX64.tmp to <Current directory>\voYW.exe
- from C:\RCX61.tmp to <Current directory>\YQIo.exe
- from C:\RCX5E.tmp to <Current directory>\iwsk.exe
- from C:\RCX5F.tmp to <Current directory>\tAIm.exe
- from C:\RCX60.tmp to <Current directory>\cYYc.exe
- from C:\RCX13.tmp to <Current directory>\skIG.exe
- from C:\RCX14.tmp to <Current directory>\FgYu.exe
- from C:\RCX15.tmp to <Current directory>\iQoU.exe
- from C:\RCX12.tmp to <Current directory>\NAkI.exe
- from C:\RCXF.tmp to <Current directory>\JksO.exe
- from C:\RCX10.tmp to <Current directory>\GAcS.exe
- from C:\RCX11.tmp to <Current directory>\bEYe.exe
- from C:\RCX1A.tmp to <Current directory>\dMgS.exe
- from C:\RCX1B.tmp to <Current directory>\iEgm.exe
- from C:\RCX1C.tmp to <Current directory>\loEE.exe
- from C:\RCX19.tmp to <Current directory>\ncsS.exe
- from C:\RCX16.tmp to <Current directory>\IAEe.exe
- from C:\RCX17.tmp to <Current directory>\AgAi.exe
- from C:\RCX18.tmp to <Current directory>\wEwu.exe
- from C:\RCX5.tmp to <Current directory>\fkII.exe
- from C:\RCX6.tmp to <Current directory>\SYYa.exe
- from C:\RCX7.tmp to <Current directory>\HEgC.exe
- from C:\RCX4.tmp to <Current directory>\MoIC.exe
- from C:\RCX1.tmp to <Current directory>\qwoY.exe
- from C:\RCX2.tmp to <Current directory>\aUoq.exe
- from C:\RCX3.tmp to <Current directory>\QgsK.exe
- from C:\RCXC.tmp to <Current directory>\DcwI.exe
- from C:\RCXD.tmp to <Current directory>\SEEe.exe
- from C:\RCXE.tmp to <Current directory>\bkAO.exe
- from C:\RCXB.tmp to <Current directory>\HMMU.exe
- from C:\RCX8.tmp to <Current directory>\oQYO.exe
- from C:\RCX9.tmp to <Current directory>\ncYI.exe
- from C:\RCXA.tmp to <Current directory>\MsIm.exe
- from C:\RCX1D.tmp to <Current directory>\XIAK.exe
- from C:\RCX30.tmp to <Current directory>\Vgwo.exe
- from C:\RCX31.tmp to <Current directory>\ukEC.exe
- from C:\RCX32.tmp to <Current directory>\YoEu.exe
- from C:\RCX2F.tmp to <Current directory>\iEYG.exe
- from C:\RCX2C.tmp to <Current directory>\qQAC.exe
- from C:\RCX2D.tmp to <Current directory>\hwAy.exe
- from C:\RCX2E.tmp to <Current directory>\uoUo.exe
- from C:\RCX37.tmp to <Current directory>\ZIwA.exe
- from C:\RCX38.tmp to <Current directory>\aMYa.exe
- from C:\RCX39.tmp to <Current directory>\kEEQ.exe
- from C:\RCX36.tmp to <Current directory>\AAEs.exe
- from C:\RCX33.tmp to <Current directory>\uwEk.exe
- from C:\RCX34.tmp to <Current directory>\Hsgu.exe
- from C:\RCX35.tmp to <Current directory>\gkkO.exe
- from C:\RCX22.tmp to <Current directory>\iAYc.exe
- from C:\RCX23.tmp to <Current directory>\hccu.exe
- from C:\RCX24.tmp to <Current directory>\vkky.exe
- from C:\RCX21.tmp to <Current directory>\tYgo.exe
- from C:\RCX1E.tmp to <Current directory>\HIsG.exe
- from C:\RCX1F.tmp to <Current directory>\ncck.exe
- from C:\RCX20.tmp to <Current directory>\qgoc.exe
- from C:\RCX29.tmp to <Current directory>\bEIw.exe
- from C:\RCX2A.tmp to <Current directory>\FMsQ.exe
- from C:\RCX2B.tmp to <Current directory>\dIQi.exe
- from C:\RCX28.tmp to <Current directory>\UkQm.exe
- from C:\RCX25.tmp to <Current directory>\tgga.exe
- from C:\RCX26.tmp to <Current directory>\aQYo.exe
- from C:\RCX27.tmp to <Current directory>\UggO.exe
- '74.##5.232.51':80
- 74.##5.232.51/
- DNS ASK google.com
- ClassName: '' WindowName: 'AcIcUcAM.exe'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'jaQEcQMQ.exe'