Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\78165621\acw.exe %TEMP%\78165621\swd=wws'
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Martin Prikryl]
- [<HKCU>\Software\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\VanDyke\SecureFX]
- [<HKLM>\Software\NCH Software\Fling\Accounts]
- [<HKCU>\Software\NCH Software\Fling\Accounts]
- [<HKLM>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\SimonTatham\PuTTY\Sessions]
- [<HKLM>\Software\SimonTatham\PuTTY\Sessions]
- [<HKLM>\Software\Martin Prikryl]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- %TEMP%\78165621\mnn.txt
- %TEMP%\78165621\frv.jpg
- %TEMP%\78165621\stn.docx
- %TEMP%\78165621\mtb.dat
- %TEMP%\78165621\acw.bmp
- %TEMP%\78165621\lvk.txt
- %TEMP%\78165621\rud.bmp
- %TEMP%\78165621\nfg.pdf
- %TEMP%\78165621\shd.xl
- %TEMP%\78165621\knx.ico
- %TEMP%\78165621\ube.mp3
- %TEMP%\78165621\hcw.bmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\78165621\pol.mp3
- %TEMP%\78165621\pec.jpg
- %TEMP%\78165621\gpt.pdf
- %TEMP%\78165621\qdv.ico
- %TEMP%\78165621\dkh.dat
- %TEMP%\78165621\hhc.txt
- %TEMP%\78165621\ecv.jpg
- %TEMP%\78165621\sca.mp4
- %TEMP%\78165621\HTSLR
- %APPDATA%\Microsoft\Protect\CREDHIST
- %TEMP%\78165621\vna.ppt
- %TEMP%\78165621\urm.mp4
- %TEMP%\78165621\tdb.mp3
- %TEMP%\78165621\jie.pdf
- %TEMP%\78165621\swd=wws
- %TEMP%\78165621\acw.exe
- %TEMP%\78165621\qch.dat
- %TEMP%\78165621\ist.icm
- %TEMP%\78165621\qfu.mp4
- %TEMP%\78165621\wns.ico
- %TEMP%\78165621\bnd.jpg
- %TEMP%\78165621\xen.txt
- %TEMP%\78165621\ilo.mp3
- %TEMP%\78165621\oas.txt
- %TEMP%\78165621\ibl.jpg
- %TEMP%\78165621\qre.mp4
- %TEMP%\78165621\clk.dat
- %TEMP%\78165621\emm.jpg
- %TEMP%\78165621\sva.docx
- %TEMP%\78165621\eru.bmp
- %TEMP%\78165621\hrl.txt
- %TEMP%\78165621\dbg.dat
- %TEMP%\78165621\djf.ppt
- %TEMP%\78165621\fuc.icm
- %TEMP%\78165621\job.ppt
- %TEMP%\78165621\jxn.ppt
- %TEMP%\78165621\jpb.mp3
- %APPDATA%\517D9D\DE2515.lck
- %TEMP%\78165621\acw.bmp
- %TEMP%\78165621\mnn.txt
- %TEMP%\78165621\mtb.dat
- %TEMP%\78165621\nfg.pdf
- %TEMP%\78165621\oas.txt
- %TEMP%\78165621\pec.jpg
- %TEMP%\78165621\pol.mp3
- %TEMP%\78165621\qch.dat
- %TEMP%\78165621\qdv.ico
- %TEMP%\78165621\qfu.mp4
- %TEMP%\78165621\rud.bmp
- %TEMP%\78165621\wns.ico
- %TEMP%\78165621\sca.mp4
- %TEMP%\78165621\shd.xl
- %TEMP%\78165621\stn.docx
- %TEMP%\78165621\sva.docx
- %TEMP%\78165621\swd=wws
- %TEMP%\78165621\tdb.mp3
- %TEMP%\78165621\ube.mp3
- %TEMP%\78165621\urm.mp4
- %TEMP%\78165621\vna.ppt
- %TEMP%\78165621\lvk.txt
- %TEMP%\78165621\qre.mp4
- %TEMP%\78165621\knx.ico
- %TEMP%\78165621\frv.jpg
- %TEMP%\78165621\acw.exe
- %TEMP%\78165621\bnd.jpg
- %TEMP%\78165621\clk.dat
- %TEMP%\78165621\dbg.dat
- %TEMP%\78165621\djf.ppt
- %TEMP%\78165621\dkh.dat
- %TEMP%\78165621\ecv.jpg
- %TEMP%\78165621\emm.jpg
- %TEMP%\78165621\eru.bmp
- %TEMP%\78165621\fuc.icm
- %TEMP%\78165621\jpb.mp3
- %TEMP%\78165621\gpt.pdf
- %TEMP%\78165621\hcw.bmp
- %TEMP%\78165621\hhc.txt
- %TEMP%\78165621\hrl.txt
- %TEMP%\78165621\ibl.jpg
- %TEMP%\78165621\ilo.mp3
- %TEMP%\78165621\ist.icm
- %TEMP%\78165621\jie.pdf
- %TEMP%\78165621\job.ppt
- %TEMP%\78165621\jxn.ppt
- %TEMP%\78165621\xen.txt
- %TEMP%\78165621\HTSLR
- %APPDATA%\517D9D\DE2515.lck
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe to %APPDATA%\517D9D\DE2515.exe
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- 'vo###kllc.com':80
- http://vo###kllc.com/js/jquery/Panel/five/fre.php
- DNS ASK vo###kllc.com
- ClassName: 'EDIT' WindowName: ''
- '%TEMP%\78165621\acw.exe' swd=wws
- '%TEMP%\78165621\acw.exe' %TEMP%\78165621\HTSLR
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'