Technical Information
Modifies file system:
Creates the following files:
- %TEMP%\~DF8C0F.tmp
- <SYSTEM32>\nsvtpduw.exe
- %TEMP%\~DF703D.tmp
- %TEMP%\~DFDAD.tmp
- <SYSTEM32>\ghpqmtgm.exe
- %TEMP%\~DF4BC6.tmp
- %TEMP%\~DF66CD.tmp
- <SYSTEM32>\pmmbefyk.exe
- %TEMP%\~DFE0AA.tmp
- %TEMP%\~DFFBF9.tmp
- %TEMP%\~DFF30D.tmp
- <SYSTEM32>\ygznzins.exe
- %TEMP%\~DF1D64.tmp
- %TEMP%\~DFBB11.tmp
- <SYSTEM32>\srofumyv.exe
- %TEMP%\~DFA043.tmp
- %TEMP%\~DFA297.tmp
- <SYSTEM32>\tnnphdyw.exe
- %TEMP%\~DF8828.tmp
- %TEMP%\~DF37FC.tmp
- <SYSTEM32>\spwmzkhs.exe
- <SYSTEM32>\zelsmurz.exe
- <SYSTEM32>\qahadxic.exe
- %TEMP%\~DFF83.tmp
- %TEMP%\~DFBD73.tmp
- <SYSTEM32>\zmjqacqd.exe
- %TEMP%\~DFA337.tmp
- %TEMP%\~DFBB76.tmp
- <SYSTEM32>\yzjmhnal.exe
- %TEMP%\~DF9FFE.tmp
- %TEMP%\~DF2B13.tmp
- <SYSTEM32>\jlmuqbxv.exe
- %TEMP%\~DF535B.tmp
- %TEMP%\~DF4726.tmp
- %TEMP%\~DF624D.tmp
- <SYSTEM32>\bagsjsbs.exe
- %TEMP%\~DFDBB1.tmp
- %TEMP%\~DFF6CF.tmp
- <SYSTEM32>\tyweezvk.exe
- %TEMP%\~DF3784.tmp
- %TEMP%\~DFCE4A.tmp
- <SYSTEM32>\nthdwgoc.exe
- %TEMP%\~DFB308.tmp
- %TEMP%\~DF41F0.tmp
- %TEMP%\~DF5EAB.tmp
- %TEMP%\~DF3AD7.tmp
- %TEMP%\~DFF23B.tmp
- <SYSTEM32>\oiitgdkh.exe
- <SYSTEM32>\dhtmluls.exe
- %TEMP%\~DF295B.tmp
- %TEMP%\~DFD98F.tmp
- <SYSTEM32>\weeuntzc.exe
- %TEMP%\~DFBFB4.tmp
- <SYSTEM32>\ooydhory.exe
- %TEMP%\~DFDDA9.tmp
- %TEMP%\~DFF9B8.tmp
- <SYSTEM32>\mjiqhkew.exe
- %TEMP%\~DF394A.tmp
- <SYSTEM32>\MSWINSCK.ocx
- %TEMP%\~DFA3F1.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\MSWINSCK[1].OCX
- %TEMP%\~DF894C.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\MSWINSCK[1].OCX
- <SYSTEM32>\uzplvkfz.exe
- %TEMP%\~DF4391.tmp
- %TEMP%\~DF560B.tmp
- <SYSTEM32>\ypvncbzi.exe
- %TEMP%\~DF3BAD.tmp
- %TEMP%\~DFEAB1.tmp
- <SYSTEM32>\ischiiyn.exe
- %TEMP%\~DF224D.tmp
- %TEMP%\~DF46CC.tmp
- <SYSTEM32>\sqbbktoy.exe
- %TEMP%\~DFB807.tmp
- %TEMP%\~DFD2A4.tmp
- %TEMP%\~DFD184.tmp
- %TEMP%\~DFDF70.tmp
- %TEMP%\~DFEB5C.tmp
- <SYSTEM32>\sorzdfmu.exe
- <SYSTEM32>\pimmfrby.exe
- %TEMP%\~DF92F1.tmp
- %TEMP%\~DF822C.tmp
- <SYSTEM32>\pmeymsrr.exe
- %TEMP%\~DF6802.tmp
- %TEMP%\~DF5A7.tmp
- <SYSTEM32>\oyrqqvmn.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\nsvtpduw.exe
- <SYSTEM32>\pmmbefyk.exe
- <SYSTEM32>\zelsmurz.exe
- <SYSTEM32>\ghpqmtgm.exe
- <SYSTEM32>\ygznzins.exe
- <SYSTEM32>\spwmzkhs.exe
- <SYSTEM32>\tnnphdyw.exe
- <SYSTEM32>\qahadxic.exe
- <SYSTEM32>\jlmuqbxv.exe
- <SYSTEM32>\yzjmhnal.exe
- <SYSTEM32>\zmjqacqd.exe
- <SYSTEM32>\bagsjsbs.exe
- <SYSTEM32>\nthdwgoc.exe
- <SYSTEM32>\tyweezvk.exe
- <SYSTEM32>\weeuntzc.exe
- <SYSTEM32>\dhtmluls.exe
- <SYSTEM32>\pimmfrby.exe
- <SYSTEM32>\oiitgdkh.exe
- <SYSTEM32>\mjiqhkew.exe
- <SYSTEM32>\uzplvkfz.exe
- <SYSTEM32>\ooydhory.exe
- <SYSTEM32>\ypvncbzi.exe
- <SYSTEM32>\sqbbktoy.exe
- <SYSTEM32>\srofumyv.exe
- <SYSTEM32>\ischiiyn.exe
- <SYSTEM32>\sorzdfmu.exe
- <SYSTEM32>\oyrqqvmn.exe
- <SYSTEM32>\pmeymsrr.exe
Deletes the following files:
- %TEMP%\~DF703D.tmp
- %TEMP%\~DF8C0F.tmp
- %TEMP%\~DFF30D.tmp
- %TEMP%\~DF66CD.tmp
- %TEMP%\~DFE0AA.tmp
- %TEMP%\~DFFBF9.tmp
- %TEMP%\~DFDAD.tmp
- %TEMP%\~DF37FC.tmp
- %TEMP%\~DFA043.tmp
- %TEMP%\~DF224D.tmp
- %TEMP%\~DF8828.tmp
- %TEMP%\~DFA297.tmp
- %TEMP%\~DF1D64.tmp
- %TEMP%\~DF4BC6.tmp
- %TEMP%\~DFA337.tmp
- %TEMP%\~DFBD73.tmp
- %TEMP%\~DF3784.tmp
- %TEMP%\~DFBB76.tmp
- %TEMP%\~DFF83.tmp
- %TEMP%\~DF2B13.tmp
- %TEMP%\~DF535B.tmp
- %TEMP%\~DFDBB1.tmp
- %TEMP%\~DF624D.tmp
- %TEMP%\~DFF6CF.tmp
- %TEMP%\~DFB308.tmp
- %TEMP%\~DF4726.tmp
- %TEMP%\~DFCE4A.tmp
- %TEMP%\~DF41F0.tmp
- %TEMP%\~DFD98F.tmp
- %TEMP%\~DF5EAB.tmp
- %TEMP%\~DFDF70.tmp
- %TEMP%\~DFBFB4.tmp
- %TEMP%\~DF4391.tmp
- %TEMP%\~DFF23B.tmp
- %TEMP%\~DFA3F1.tmp
- %TEMP%\~DF394A.tmp
- %TEMP%\~DFF9B8.tmp
- %TEMP%\~DF894C.tmp
- %TEMP%\~DF3AD7.tmp
- %TEMP%\~DFDDA9.tmp
- %TEMP%\~DF295B.tmp
- %TEMP%\~DF3BAD.tmp
- %TEMP%\~DFD2A4.tmp
- %TEMP%\~DFD184.tmp
- %TEMP%\~DFBB11.tmp
- %TEMP%\~DFB807.tmp
- %TEMP%\~DF46CC.tmp
- %TEMP%\~DF560B.tmp
- %TEMP%\~DF822C.tmp
- %TEMP%\~DF92F1.tmp
- %TEMP%\~DF5A7.tmp
- %TEMP%\~DF6802.tmp
- %TEMP%\~DFEAB1.tmp
- %TEMP%\~DFEB5C.tmp
Network activity:
Connects to:
- 'localhost':1071
- 'localhost':1073
- 'localhost':1075
- 'localhost':1069
- 'localhost':1063
- 'localhost':1065
- 'localhost':1067
- 'localhost':1085
- 'localhost':1087
- 'localhost':1089
- 'localhost':1083
- 'localhost':1077
- 'localhost':1079
- 'localhost':1081
- 'localhost':1061
- 'localhost':1043
- 'localhost':1044
- 'localhost':1046
- 'localhost':1041
- 'localhost':1036
- 'pd###.egloos.com':80
- 'localhost':1039
- 'localhost':1055
- 'localhost':1057
- 'localhost':1059
- 'localhost':1053
- 'localhost':1048
- 'localhost':1050
- 'localhost':1051
TCP:
HTTP GET requests:
- http://pd###.egloos.com/pds/201401/25/40/MSWINSCK.OCX
UDP:
- DNS ASK pd###.egloos.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
Creates and executes the following:
- '<SYSTEM32>\ghpqmtgm.exe'
- '<SYSTEM32>\nsvtpduw.exe'
- '<SYSTEM32>\pmmbefyk.exe'
- '<SYSTEM32>\ygznzins.exe'
- '<SYSTEM32>\spwmzkhs.exe'
- '<SYSTEM32>\tnnphdyw.exe'
- '<SYSTEM32>\zelsmurz.exe'
- '<SYSTEM32>\zmjqacqd.exe'
- '<SYSTEM32>\qahadxic.exe'
- '<SYSTEM32>\jlmuqbxv.exe'
- '<SYSTEM32>\bagsjsbs.exe'
- '<SYSTEM32>\nthdwgoc.exe'
- '<SYSTEM32>\tyweezvk.exe'
- '<SYSTEM32>\srofumyv.exe'
- '<SYSTEM32>\oiitgdkh.exe'
- '<SYSTEM32>\weeuntzc.exe'
- '<SYSTEM32>\dhtmluls.exe'
- '<SYSTEM32>\mjiqhkew.exe'
- '<SYSTEM32>\uzplvkfz.exe'
- '<SYSTEM32>\ooydhory.exe'
- '<SYSTEM32>\pimmfrby.exe'
- '<SYSTEM32>\ischiiyn.exe'
- '<SYSTEM32>\ypvncbzi.exe'
- '<SYSTEM32>\sqbbktoy.exe'
- '<SYSTEM32>\sorzdfmu.exe'
- '<SYSTEM32>\oyrqqvmn.exe'
- '<SYSTEM32>\pmeymsrr.exe'
