Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SystemRec.exe' = '%APPDATA%\Microsoft\Protect\Z-6-8-02-0147281012-018237041-9816430924-9142\P-1-5-16-7923435274-12478148975817408994-4122...
Creates the following files on removable media
- <Drive name for removable media>:\usb fix.exe
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\pushkin.jpg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\1189.jpg
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %WINDIR%\syswow64\msmgr.exe
- %ProgramFiles(x86)%\steam\resource\overlay_portuguese.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_polish.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_norwegian.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_koreana.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_korean.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_japanese.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_italian.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_german.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_french.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_finnish.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_english.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_dutch.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_danish.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_czech.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_greek.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_bulgarian.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_romanian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_bulgarian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_greek.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_german.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_french.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_finnish.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_english.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_dutch.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_danish.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_schinese.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_russian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_turkish.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_thai.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_swedish.txt.v316
- %ProgramFiles(x86)%\steam\resource\overlay_spanish.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_czech.txt.v316
- %ProgramFiles(x86)%\steam\resource\camera1.wav.v316
- %ProgramFiles(x86)%\steam\public\url_list.txt.v316
- %ProgramFiles(x86)%\steam\public\steam_updating.ico.v316
- %ProgramFiles(x86)%\steam\public\steamui_german.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_french.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_finnish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_english.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_dutch.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_danish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_czech.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_turkish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_thai.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_swedish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_spanish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_bulgarian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_italian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_greek.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_japanese.txt.v316
- %ProgramFiles(x86)%\steam\public\steam_tray.ico.v316
- %ProgramFiles(x86)%\steam\public\steamui_spanish.txt.v316
- %ProgramFiles(x86)%\steam\public\steam_offline.ico.v316
- %ProgramFiles(x86)%\steam\public\steam_cloudsync.ico.v316
- %ProgramFiles(x86)%\steam\public\steamui_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_turkish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_thai.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_swedish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_schinese.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_korean.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_russian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_romanian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_postlogon_greek.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_portuguese.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_polish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_norwegian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamui_koreana.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_italian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_japanese.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_korean.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_italian.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_greek.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_german.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_french.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_finnish.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_english.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_japanese.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_dutch.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_czech.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_bulgarian.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\servers\game_ready.wav.v316
- %ProgramFiles(x86)%\steam\resource\warning.wav.v316
- %ProgramFiles(x86)%\steam\resource\voice_ringing.wav.v316
- %ProgramFiles(x86)%\steam\resource\voice_dialing.wav.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_danish.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_korean.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_koreana.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_norwegian.txt.v316
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico.v316
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.v316
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.v316
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.v316
- %ProgramFiles(x86)%\winamp\plugins\winampflv.swf.v316
- %ProgramFiles(x86)%\steam\skins\skins_readme.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_turkish.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_thai.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_swedish.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_spanish.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_schinese.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_russian.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_romanian.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_portuguese.txt.v316
- %ProgramFiles(x86)%\steam\servers\serverbrowser_polish.txt.v316
- %ProgramFiles(x86)%\steam\resource\voice_busy.wav.v316
- %ProgramFiles(x86)%\steam\resource\vgui_turkish.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_thai.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_czech.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_bulgarian.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_turkish.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_thai.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_danish.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_swedish.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_schinese.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_russian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_romanian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_portuguese.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_polish.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_norwegian.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_koreana.txt.v316
- %ProgramFiles(x86)%\steam\resource\platform_spanish.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_dutch.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_english.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_finnish.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_swedish.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_spanish.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_schinese.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_russian.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_romanian.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_portuguese.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_polish.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_norwegian.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_koreana.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_korean.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_japanese.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_italian.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_greek.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_german.txt.v316
- %ProgramFiles(x86)%\steam\resource\vgui_french.txt.v316
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.v316
- %ProgramFiles(x86)%\steam\public\steamclean_schinese.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_russian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_romanian.txt.v316
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.v316
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.v316
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.v316
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.v316
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.v316
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.v316
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.v316
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.v316
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.v316
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.v316
- %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtime.xml.v316
- %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.v316
- %ProgramFiles%\microsoft office\office14\splashscreen.bmp.v316
- %ProgramFiles%\microsoft office\office14\sketchpadtestschema.xml.v316
- %ProgramFiles%\microsoft office\office14\microsoft.sharepoint.businessdata.administration.client.xml.v316
- %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.xml.xml.v316
- %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.semitrust.xml.v316
- %ProgramFiles%\microsoft office\office14\microsoft.office.businessdata.xml.v316
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml.v316
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml.v316
- %ProgramFiles%\microsoft office\office14\microsoft.businessdata.xml.v316
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.v316
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.v316
- %ProgramFiles%\java\jre1.8.0_45\readme.txt.v316
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml.v316
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml.v316
- %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtimeui.xml.v316
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.v316
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.v316
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.v316
- %ProgramFiles(x86)%\qip 2012\unins000.dat.v316
- %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.v316
- %ProgramFiles(x86)%\opera\installation_status.xml.v316
- %ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml.v316
- %ProgramFiles(x86)%\mirc\versions.txt.v316
- %ProgramFiles(x86)%\mirc\readme.txt.v316
- %ProgramFiles(x86)%\steam\thirdpartylegalnotices.doc.v316
- %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.v316
- %ProgramFiles%\winrar\whatsnew.txt.v316
- %ProgramFiles%\winrar\readme.txt.v316
- %ProgramFiles%\winrar\rarnew.dat.v316
- %ProgramFiles%\winrar\rar.txt.v316
- %ProgramFiles%\winrar\license.txt.v316
- C:\microsoft\windows\windowsnetworkmanager.exe
- %APPDATA%\microsoft\protect\z-6-8-02-0147281012-018237041-9816430924-9142\p-1-5-16-7923435274-12478148975817408994-4122\systemrec.exe
- %ProgramFiles%\winrar\zipnew.dat.v316
- %ProgramFiles(x86)%\winamp\whatsnew.txt.v316
- %ProgramFiles(x86)%\qip 2012\unins000.msg.v316
- %ALLUSERSPROFILE%\microsoft toolkit\settings.xml.v316
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.v316
- C:\far2\documentation\rus\plugins_install.txt.v316
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.v316
- C:\far2\plugins\ftp\notes_rus.txt.v316
- C:\far2\plugins\ftp\notes.txt.v316
- C:\far2\plugins\ftp\ftpcmds_rus.txt.v316
- C:\far2\plugins\ftp\ftpcmds.txt.v316
- C:\far2\documentation\rus\techinfo.txt.v316
- C:\far2\documentation\rus\plugins_review.txt.v316
- C:\far2\documentation\rus\far_faq.txt.v316
- C:\far2\documentation\eng\arc_support.txt.v316
- C:\far2\documentation\rus\bug_report.txt.v316
- C:\far2\documentation\rus\arc_support.txt.v316
- C:\far2\documentation\eng\techinfo.txt.v316
- C:\far2\documentation\eng\plugins_review.txt.v316
- C:\far2\documentation\eng\plugins_install.txt.v316
- C:\far2\documentation\eng\far_faq.txt.v316
- C:\far2\documentation\eng\bug_report.txt.v316
- %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.v316
- %ProgramFiles(x86)%\k-lite codec pack\icons\config.ico.v316
- %ProgramFiles(x86)%\k-lite codec pack\icons\delete.ico.v316
- %ProgramFiles(x86)%\k-lite codec pack\icons\x264vfw.ico.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_polish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_norwegian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_korean.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_japanese.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_italian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_greek.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_german.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_french.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_finnish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_english.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_dutch.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_danish.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_czech.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt.v316
- %ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_japanese.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_italian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_hungarian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_greek.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_german.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_french.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_finnish.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_korean.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_english.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_danish.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_czech.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_bulgarian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_brazilian.txt.v316
- %ProgramFiles(x86)%\steam\friends\message.wav.v316
- %ProgramFiles(x86)%\steam\friends\friend_online.wav.v316
- %ProgramFiles(x86)%\steam\friends\friend_join.wav.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_dutch.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_koreana.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_norwegian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_polish.txt.v316
- %ProgramFiles(x86)%\steam\public\check.ico.v316
- %ProgramFiles(x86)%\steam\logs\content_log.txt.v316
- %ProgramFiles(x86)%\steam\logs\connection_log.txt.v316
- %ProgramFiles(x86)%\steam\logs\configstore_log.txt.v316
- %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.v316
- %ProgramFiles(x86)%\steam\html5app\keybinds.cfg.v316
- %ProgramFiles(x86)%\steam\friends\voice_hang_up.wav.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_ukrainian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_turkish.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_thai.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_tchinese.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_swedish.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_spanish.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_schinese.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_russian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_romanian.txt.v316
- %ProgramFiles(x86)%\steam\friends\trackerui_portuguese.txt.v316
- %ProgramFiles(x86)%\steam\public\steamclean_portuguese.txt.v316
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.v316
Deletes itself.
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ch####p.dyndns.org':80
UDP
- DNS ASK ch####p.dyndns.org
Miscellaneous
Creates and executes the following
- 'C:\microsoft\windows\windowsnetworkmanager.exe' <Full path to file>
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "C:\microsoft\windows\windowsnetw...