Trojan.Siggen11.57770

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\YowQipOVS] 'ImagePath' = '%TEMP%\YowQ.sys'

Creates the following services

'YowQipOVS' %TEMP%\YowQ.sys

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\cleanmgr.exe

Modifies file system

Creates the following files

%WINDIR%\9775\csrss.exe
%TEMP%\bjvztbn.txt
%WINDIR%\bmralb.exe
%WINDIR%\syswow64\wflhul.exe
%WINDIR%\4344.bat
%WINDIR%\9775\agisv\qqfqz.exe
%TEMP%\ftusrhs.txt
%TEMP%\faeaf17d554ad2ded894af11243d8b303aeb8.tmp
%WINDIR%\eaoeng.vbs
%WINDIR%\wincom32.dll
%WINDIR%\9775\nrtft\mudwe.exe
%TEMP%\waqwaem.txt
%WINDIR%\9775\mhadj\eqbrm.exe
%WINDIR%\9775\zvxrk\igcki.exe
%WINDIR%\gilnmc.dll
%WINDIR%\sbmwne.exe
%WINDIR%\9775\zklhh\ycyfq.exe
%TEMP%\ojoucob.txt
%WINDIR%\9775\agisv\qqfqz.txt
%WINDIR%\9775\mhadj\eqbrm.txt
%WINDIR%\9775\nrtft\mudwe.txt
%WINDIR%\9775\zvxrk\igcki.txt
%WINDIR%\9775\zklhh\ycyfq.txt
%WINDIR%\9775\tzsgkh.dll
%WINDIR%\9775\qlqzzn.dll
%TEMP%\aucgcgy.txt
%TEMP%\yowq.sys

Deletes the following files

%WINDIR%\9775\zklhh\ycyfq.exe
%WINDIR%\bmralb.exe
%TEMP%\yowq.sys

Deletes itself.

Network activity

Connects to

'10#.#5.86.163':7777
'co####.kfjiec8.com':80

TCP

HTTP GET requests

http://lm.##wangba.com/GetCfg?V=####################################################
http://xf.#4z.cn/pap/tc202012242.txt?ve############################################################################################################
http://xf.#4z.cn/pap/tt202012302.txt?ve############################################################################################################
http://xf.#4z.cn/pap/gg202012291.txt?ve############################################################################################################
http://xf.#4z.cn/pap/bl202012291.txt?ve############################################################################################################
http://xf.#4z.cn/pap/yjs20201118.txt1?ve############################################################################################################
http://10#.##.213.120:808/ip.php via 10#.#9.213.120
http://10#.##.213.120:808/asny.bin via 10#.#9.213.120
http://ti####ic.baidu.com/tieba/pic/item/cffc1e178a82b901bc520176648da9773812effd.jpg
http://21#.##0.218.154:808/xjg.bin via 21#.#50.218.154
http://www.ip##.net/
http://pv.#ohu.com/cityjson
http://47.##.214.214:6666/a850c9970bb7cd2b7e65011e87a02ef5.txt
http://ap#.#bbtv.xyz/c.php?pi###################################
http://47.##.68.142/av.php

HTTP POST requests

http://10#.##.210.144:808/asny/install.php via 10#.#9.210.144
http://da##.58pap.com/addInfoCheck1
http://da##.58pap.com/addInfoCheck2

'ba###gif.com':2653

'47.##6.10.26':6663

UDP

DNS ASK da##.58pap.com
DNS ASK jj####9p.58guyu.com
DNS ASK pv.#ohu.com
DNS ASK ip##.net
DNS ASK ti####ic.baidu.com
DNS ASK ba###gif.com
DNS ASK da##.58pap.cn
DNS ASK xf.#4z.cn
DNS ASK ap#.#bbtv.xyz
DNS ASK co####.kfjiec8.com
DNS ASK lm.##wangba.com
'<LOCALNET>.28.181':6582
'<LOCALNET>.28.180':6582
'<LOCALNET>.28.179':6582
'<LOCALNET>.28.178':6582
'<LOCALNET>.28.177':6582
'<LOCALNET>.28.171':6582
'<LOCALNET>.28.175':6582
'<LOCALNET>.28.174':6582
'<LOCALNET>.28.173':6582
'<LOCALNET>.28.172':6582
'<LOCALNET>.28.170':6582
'<LOCALNET>.28.176':6582
'<LOCALNET>.28.182':6582
'<LOCALNET>.28.188':6582
'<LOCALNET>.28.185':6582
'<LOCALNET>.28.186':6582
'<LOCALNET>.28.187':6582
'<LOCALNET>.28.255':6588
'<LOCALNET>.28.189':6582
'<LOCALNET>.28.190':6582
'<LOCALNET>.28.191':6582
'<LOCALNET>.28.192':6582
'<LOCALNET>.28.193':6582
'<LOCALNET>.28.194':6582
'<LOCALNET>.28.195':6582
'<LOCALNET>.28.183':6582
'<LOCALNET>.28.184':6582
'<LOCALNET>.28.196':6582
'<LOCALNET>.28.164':6582
'<LOCALNET>.28.166':6582
'<LOCALNET>.28.141':6582
'<LOCALNET>.28.142':6582
'<LOCALNET>.28.143':6582
'<LOCALNET>.28.144':6582
'<LOCALNET>.28.145':6582
'<LOCALNET>.28.146':6582
'<LOCALNET>.28.147':6582
'<LOCALNET>.28.148':6582
'<LOCALNET>.28.149':6582
'<LOCALNET>.28.150':6582
'<LOCALNET>.28.151':6582
'<LOCALNET>.28.168':6582
'<LOCALNET>.28.169':6582
'<LOCALNET>.28.152':6582
'<LOCALNET>.28.155':6582
'<LOCALNET>.28.156':6582
'<LOCALNET>.28.157':6582
'<LOCALNET>.28.158':6582
'<LOCALNET>.28.159':6582
'<LOCALNET>.28.160':6582
'<LOCALNET>.28.161':6582
'<LOCALNET>.28.162':6582
'<LOCALNET>.28.163':6582
'<LOCALNET>.28.154':6582
'<LOCALNET>.28.165':6582
'<LOCALNET>.28.197':6582
'<LOCALNET>.28.153':6582
'<LOCALNET>.28.198':6582
'<LOCALNET>.28.206':6582
'<LOCALNET>.28.201':6582
'<LOCALNET>.28.238':6582
'<LOCALNET>.28.239':6582
'<LOCALNET>.28.240':6582
'<LOCALNET>.28.241':6582
'<LOCALNET>.28.242':6582
'<LOCALNET>.28.243':6582
'<LOCALNET>.28.244':6582
'<LOCALNET>.28.245':6582
'<LOCALNET>.28.246':6582
'<LOCALNET>.28.247':6582
'<LOCALNET>.28.248':6582
'<LOCALNET>.28.249':6582
'<LOCALNET>.28.200':6582
'<LOCALNET>.28.237':6582
'<LOCALNET>.28.252':6582
'<LOCALNET>.28.253':6582
'<LOCALNET>.28.254':6582
'<LOCALNET>.28.1':6583
'<LOCALNET>.28.2':6583
'<LOCALNET>.28.3':6583
'<LOCALNET>.28.4':6583
'<LOCALNET>.28.5':6583
'<LOCALNET>.28.6':6583
'<LOCALNET>.28.7':6583
'<LOCALNET>.28.8':6583
'<LOCALNET>.28.9':6583
'<LOCALNET>.28.250':6582
'<LOCALNET>.28.199':6582
'<LOCALNET>.28.251':6582
'<LOCALNET>.28.236':6582
'<LOCALNET>.28.202':6582
'<LOCALNET>.28.203':6582
'<LOCALNET>.28.167':6582
'<LOCALNET>.28.207':6582
'<LOCALNET>.28.208':6582
'<LOCALNET>.28.209':6582
'<LOCALNET>.28.210':6582
'<LOCALNET>.28.211':6582
'<LOCALNET>.28.212':6582
'<LOCALNET>.28.213':6582
'<LOCALNET>.28.214':6582
'<LOCALNET>.28.234':6582
'<LOCALNET>.28.135':6582
'<LOCALNET>.28.235':6582
'<LOCALNET>.28.218':6582
'<LOCALNET>.28.219':6582
'<LOCALNET>.28.220':6582
'<LOCALNET>.28.221':6582
'<LOCALNET>.28.222':6582
'<LOCALNET>.28.223':6582
'<LOCALNET>.28.224':6582
'<LOCALNET>.28.225':6582
'<LOCALNET>.28.226':6582
'<LOCALNET>.28.227':6582
'<LOCALNET>.28.233':6582
'<LOCALNET>.28.215':6582
'<LOCALNET>.28.217':6582
'<LOCALNET>.28.216':6582
'<LOCALNET>.28.130':6582
'<LOCALNET>.28.133':6582
'<LOCALNET>.28.40':6582
'<LOCALNET>.28.41':6582
'<LOCALNET>.28.42':6582
'<LOCALNET>.28.48':6582
'<LOCALNET>.28.49':6582
'<LOCALNET>.28.50':6582
'<LOCALNET>.28.51':6582
'<LOCALNET>.28.52':6582
'<LOCALNET>.28.53':6582
'<LOCALNET>.28.54':6582
'<LOCALNET>.28.55':6582
'<LOCALNET>.28.70':6582
'<LOCALNET>.28.39':6582
'<LOCALNET>.28.38':6582
'<LOCALNET>.28.59':6582
'<LOCALNET>.28.60':6582
'<LOCALNET>.28.61':6582
'<LOCALNET>.28.62':6582
'<LOCALNET>.28.63':6582
'<LOCALNET>.28.64':6582
'<LOCALNET>.28.65':6582
'<LOCALNET>.28.66':6582
'<LOCALNET>.28.67':6582
'<LOCALNET>.28.68':6582
'<LOCALNET>.28.69':6582
'<LOCALNET>.28.56':6582
'<LOCALNET>.28.58':6582
'<LOCALNET>.28.132':6582
'<LOCALNET>.28.57':6582
'<LOCALNET>.28.22':6582
'<LOCALNET>.28.8':6582
'<LOCALNET>.28.9':6582
'<LOCALNET>.28.10':6582
'<LOCALNET>.28.11':6582
'<LOCALNET>.28.12':6582
'<LOCALNET>.28.13':6582
'<LOCALNET>.28.14':6582
'<LOCALNET>.28.15':6582
'<LOCALNET>.28.16':6582
'<LOCALNET>.28.17':6582
'<LOCALNET>.28.18':6582
'<LOCALNET>.28.35':6582
'<LOCALNET>.28.37':6582
'<LOCALNET>.28.36':6582
'<LOCALNET>.28.24':6582
'<LOCALNET>.28.25':6582
'<LOCALNET>.28.26':6582
'<LOCALNET>.28.27':6582
'<LOCALNET>.28.28':6582
'<LOCALNET>.28.29':6582
'<LOCALNET>.28.30':6582
'<LOCALNET>.28.31':6582
'<LOCALNET>.28.32':6582
'<LOCALNET>.28.33':6582
'<LOCALNET>.28.34':6582
'<LOCALNET>.28.21':6582
'<LOCALNET>.28.23':6582
'<LOCALNET>.28.134':6582
'<LOCALNET>.28.10':6583
'<LOCALNET>.28.74':6582
'<LOCALNET>.28.105':6582
'<LOCALNET>.28.106':6582
'<LOCALNET>.28.107':6582
'<LOCALNET>.28.108':6582
'<LOCALNET>.28.109':6582
'<LOCALNET>.28.110':6582
'<LOCALNET>.28.111':6582
'<LOCALNET>.28.114':6582
'<LOCALNET>.28.115':6582
'<LOCALNET>.28.116':6582
'<LOCALNET>.28.117':6582
'<LOCALNET>.28.72':6582
'<LOCALNET>.28.104':6582
'<LOCALNET>.28.103':6582
'<LOCALNET>.28.121':6582
'<LOCALNET>.28.122':6582
'<LOCALNET>.28.123':6582
'<LOCALNET>.28.124':6582
'<LOCALNET>.28.125':6582
'<LOCALNET>.28.126':6582
'<LOCALNET>.28.127':6582
'<LOCALNET>.28.128':6582
'<LOCALNET>.28.129':6582
'<LOCALNET>.28.87':6582
'<LOCALNET>.28.131':6582
'<LOCALNET>.28.118':6582
'<LOCALNET>.28.120':6582
'<LOCALNET>.28.73':6582
'<LOCALNET>.28.119':6582
'<LOCALNET>.28.71':6582
'<LOCALNET>.28.75':6582
'<LOCALNET>.28.76':6582
'<LOCALNET>.28.77':6582
'<LOCALNET>.28.78':6582
'<LOCALNET>.28.79':6582
'<LOCALNET>.28.80':6582
'<LOCALNET>.28.81':6582
'<LOCALNET>.28.82':6582
'<LOCALNET>.28.83':6582
'<LOCALNET>.28.84':6582
'<LOCALNET>.28.85':6582
'<LOCALNET>.28.100':6582
'<LOCALNET>.28.102':6582
'<LOCALNET>.28.101':6582
'<LOCALNET>.28.89':6582
'<LOCALNET>.28.90':6582
'<LOCALNET>.28.91':6582
'<LOCALNET>.28.92':6582
'<LOCALNET>.28.93':6582
'<LOCALNET>.28.94':6582
'<LOCALNET>.28.95':6582
'<LOCALNET>.28.96':6582
'<LOCALNET>.28.97':6582
'<LOCALNET>.28.98':6582
'<LOCALNET>.28.99':6582
'<LOCALNET>.28.86':6582
'<LOCALNET>.28.88':6582
'<LOCALNET>.28.4':6582
'<LOCALNET>.28.18':6583
'<LOCALNET>.28.13':6583
'<LOCALNET>.28.173':6583
'<LOCALNET>.28.174':6583
'<LOCALNET>.28.175':6583
'<LOCALNET>.28.176':6583
'<LOCALNET>.28.177':6583
'<LOCALNET>.28.178':6583
'<LOCALNET>.28.179':6583
'<LOCALNET>.28.180':6583
'<LOCALNET>.28.181':6583
'<LOCALNET>.28.182':6583
'<LOCALNET>.28.183':6583
'<LOCALNET>.28.198':6583
'<LOCALNET>.28.172':6583
'<LOCALNET>.28.171':6583
'<LOCALNET>.28.187':6583
'<LOCALNET>.28.188':6583
'<LOCALNET>.28.189':6583
'<LOCALNET>.28.190':6583
'<LOCALNET>.28.191':6583
'<LOCALNET>.28.192':6583
'<LOCALNET>.28.193':6583
'<LOCALNET>.28.194':6583
'<LOCALNET>.28.195':6583
'<LOCALNET>.28.196':6583
'<LOCALNET>.28.197':6583
'<LOCALNET>.28.184':6583
'<LOCALNET>.28.186':6583
'<LOCALNET>.28.136':6583
'<LOCALNET>.28.185':6583
'<LOCALNET>.28.150':6583
'<LOCALNET>.28.138':6583
'<LOCALNET>.28.139':6583
'<LOCALNET>.28.140':6583
'<LOCALNET>.28.141':6583
'<LOCALNET>.28.142':6583
'<LOCALNET>.28.143':6583
'<LOCALNET>.28.144':6583
'<LOCALNET>.28.145':6583
'<LOCALNET>.28.146':6583
'<LOCALNET>.28.147':6583
'<LOCALNET>.28.148':6583
'<LOCALNET>.28.168':6583
'<LOCALNET>.28.170':6583
'<LOCALNET>.28.169':6583
'<LOCALNET>.28.152':6583
'<LOCALNET>.28.153':6583
'<LOCALNET>.28.159':6583
'<LOCALNET>.28.160':6583
'<LOCALNET>.28.161':6583
'<LOCALNET>.28.162':6583
'<LOCALNET>.28.163':6583
'<LOCALNET>.28.164':6583
'<LOCALNET>.28.165':6583
'<LOCALNET>.28.166':6583
'<LOCALNET>.28.167':6583
'<LOCALNET>.28.149':6583
'<LOCALNET>.28.151':6583
'<LOCALNET>.28.137':6583
'<LOCALNET>.28.199':6583
'<LOCALNET>.28.203':6583
'<LOCALNET>.28.235':6583
'<LOCALNET>.28.236':6583
'<LOCALNET>.28.237':6583
'<LOCALNET>.28.238':6583
'<LOCALNET>.28.239':6583
'<LOCALNET>.28.240':6583
'<LOCALNET>.28.241':6583
'<LOCALNET>.28.242':6583
'<LOCALNET>.28.243':6583
'<LOCALNET>.28.244':6583
'<LOCALNET>.28.245':6583
'<LOCALNET>.28.233':6583
'<LOCALNET>.28.234':6583
'<LOCALNET>.28.251':6583
'<LOCALNET>.28.254':6583
'<LOCALNET>.28.1':6584
'<LOCALNET>.28.2':6584
'<LOCALNET>.28.3':6584
'<LOCALNET>.28.4':6584
'<LOCALNET>.28.255':6585
'<LOCALNET>.28.255':6584
'<LOCALNET>.28.255':6583
'<LOCALNET>.28.255':6582
'<LOCALNET>.28.255':6581
'<LOCALNET>.28.255':6580
'<LOCALNET>.28.252':6583
'<LOCALNET>.28.253':6583
'<LOCALNET>.28.201':6583
'<LOCALNET>.28.200':6583
'<LOCALNET>.28.230':6583
'<LOCALNET>.28.204':6583
'<LOCALNET>.28.205':6583
'<LOCALNET>.28.206':6583
'<LOCALNET>.28.207':6583
'<LOCALNET>.28.208':6583
'<LOCALNET>.28.209':6583
'<LOCALNET>.28.210':6583
'<LOCALNET>.28.211':6583
'<LOCALNET>.28.212':6583
'<LOCALNET>.28.213':6583
'<LOCALNET>.28.231':6583
'<LOCALNET>.28.202':6583
'<LOCALNET>.28.232':6583
'<LOCALNET>.28.214':6583
'<LOCALNET>.28.218':6583
'<LOCALNET>.28.219':6583
'<LOCALNET>.28.220':6583
'<LOCALNET>.28.221':6583
'<LOCALNET>.28.224':6583
'<LOCALNET>.28.225':6583
'<LOCALNET>.28.226':6583
'<LOCALNET>.28.227':6583
'<LOCALNET>.28.228':6583
'<LOCALNET>.28.229':6583
'<LOCALNET>.28.215':6583
'<LOCALNET>.28.216':6583
'<LOCALNET>.28.217':6583
'<LOCALNET>.28.6':6582
'<LOCALNET>.28.135':6583
'<LOCALNET>.28.133':6583
'<LOCALNET>.28.47':6583
'<LOCALNET>.28.48':6583
'<LOCALNET>.28.49':6583
'<LOCALNET>.28.50':6583
'<LOCALNET>.28.51':6583
'<LOCALNET>.28.52':6583
'<LOCALNET>.28.53':6583
'<LOCALNET>.28.54':6583
'<LOCALNET>.28.55':6583
'<LOCALNET>.28.56':6583
'<LOCALNET>.28.57':6583
'<LOCALNET>.28.45':6583
'<LOCALNET>.28.73':6583
'<LOCALNET>.28.42':6583
'<LOCALNET>.28.61':6583
'<LOCALNET>.28.62':6583
'<LOCALNET>.28.63':6583
'<LOCALNET>.28.64':6583
'<LOCALNET>.28.65':6583
'<LOCALNET>.28.66':6583
'<LOCALNET>.28.68':6583
'<LOCALNET>.28.69':6583
'<LOCALNET>.28.70':6583
'<LOCALNET>.28.71':6583
'<LOCALNET>.28.72':6583
'<LOCALNET>.28.59':6583
'<LOCALNET>.28.58':6583
'<LOCALNET>.28.60':6583
'<LOCALNET>.28.40':6583
'<LOCALNET>.28.28':6583
'<LOCALNET>.28.15':6583
'<LOCALNET>.28.16':6583
'<LOCALNET>.28.17':6583
'<LOCALNET>.28.7':6582
'<LOCALNET>.28.19':6583
'<LOCALNET>.28.20':6583
'<LOCALNET>.28.21':6583
'<LOCALNET>.28.22':6583
'<LOCALNET>.28.23':6583
'<LOCALNET>.28.24':6583
'<LOCALNET>.28.25':6583
'<LOCALNET>.28.41':6583
'<LOCALNET>.28.134':6583
'<LOCALNET>.28.14':6583
'<LOCALNET>.28.29':6583
'<LOCALNET>.28.30':6583
'<LOCALNET>.28.31':6583
'<LOCALNET>.28.32':6583
'<LOCALNET>.28.33':6583
'<LOCALNET>.28.34':6583
'<LOCALNET>.28.35':6583
'<LOCALNET>.28.36':6583
'<LOCALNET>.28.37':6583
'<LOCALNET>.28.38':6583
'<LOCALNET>.28.39':6583
'<LOCALNET>.28.27':6583
'<LOCALNET>.28.26':6583
'<LOCALNET>.28.46':6583
'<LOCALNET>.28.74':6583
'<LOCALNET>.28.107':6583
'<LOCALNET>.28.109':6583
'<LOCALNET>.28.110':6583
'<LOCALNET>.28.111':6583
'<LOCALNET>.28.112':6583
'<LOCALNET>.28.113':6583
'<LOCALNET>.28.114':6583
'<LOCALNET>.28.115':6583
'<LOCALNET>.28.116':6583
'<LOCALNET>.28.117':6583
'<LOCALNET>.28.118':6583
'<LOCALNET>.28.106':6583
'<LOCALNET>.28.105':6583
'<LOCALNET>.28.108':6583
'<LOCALNET>.28.119':6583
'<LOCALNET>.28.123':6583
'<LOCALNET>.28.124':6583
'<LOCALNET>.28.125':6583
'<LOCALNET>.28.126':6583
'<LOCALNET>.28.127':6583
'<LOCALNET>.28.128':6583
'<LOCALNET>.28.129':6583
'<LOCALNET>.28.130':6583
'<LOCALNET>.28.131':6583
'<LOCALNET>.28.132':6583
'<LOCALNET>.28.120':6583
'<LOCALNET>.28.121':6583
'<LOCALNET>.28.122':6583
'<LOCALNET>.28.75':6583
'<LOCALNET>.28.103':6583
'<LOCALNET>.28.76':6583
'<LOCALNET>.28.78':6583
'<LOCALNET>.28.79':6583
'<LOCALNET>.28.80':6583
'<LOCALNET>.28.81':6583
'<LOCALNET>.28.82':6583
'<LOCALNET>.28.83':6583
'<LOCALNET>.28.84':6583
'<LOCALNET>.28.85':6583
'<LOCALNET>.28.86':6583
'<LOCALNET>.28.87':6583
'<LOCALNET>.28.88':6583
'<LOCALNET>.28.104':6583
'<LOCALNET>.28.77':6583
'<LOCALNET>.28.89':6583
'<LOCALNET>.28.92':6583
'<LOCALNET>.28.93':6583
'<LOCALNET>.28.94':6583
'<LOCALNET>.28.95':6583
'<LOCALNET>.28.96':6583
'<LOCALNET>.28.97':6583
'<LOCALNET>.28.98':6583
'<LOCALNET>.28.99':6583
'<LOCALNET>.28.252':6580
'<LOCALNET>.28.101':6583
'<LOCALNET>.28.102':6583
'<LOCALNET>.28.90':6583
'<LOCALNET>.28.91':6583
'<LOCALNET>.28.11':6583
'<LOCALNET>.28.5':6582
'<LOCALNET>.28.1':6582
'<LOCALNET>.28.3':6582
'<LOCALNET>.28.159':6580
'<LOCALNET>.28.160':6580
'<LOCALNET>.28.161':6580
'<LOCALNET>.28.162':6580
'<LOCALNET>.28.163':6580
'<LOCALNET>.28.164':6580
'<LOCALNET>.28.165':6580
'<LOCALNET>.28.166':6580
'<LOCALNET>.28.167':6580
'<LOCALNET>.28.168':6580
'<LOCALNET>.28.154':6580
'<LOCALNET>.28.153':6580
'<LOCALNET>.28.158':6580
'<LOCALNET>.28.169':6580
'<LOCALNET>.28.173':6580
'<LOCALNET>.28.174':6580
'<LOCALNET>.28.175':6580
'<LOCALNET>.28.176':6580
'<LOCALNET>.28.177':6580
'<LOCALNET>.28.178':6580
'<LOCALNET>.28.184':6580
'<LOCALNET>.28.185':6580
'<LOCALNET>.28.186':6580
'<LOCALNET>.28.187':6580
'<LOCALNET>.28.170':6580
'<LOCALNET>.28.171':6580
'<LOCALNET>.28.172':6580
'<LOCALNET>.28.122':6580
'<LOCALNET>.28.188':6580
'<LOCALNET>.28.124':6580
'<LOCALNET>.28.127':6580
'<LOCALNET>.28.128':6580
'<LOCALNET>.28.129':6580
'<LOCALNET>.28.130':6580
'<LOCALNET>.28.131':6580
'<LOCALNET>.28.132':6580
'<LOCALNET>.28.133':6580
'<LOCALNET>.28.134':6580
'<LOCALNET>.28.135':6580
'<LOCALNET>.28.136':6580
'<LOCALNET>.28.152':6580
'<LOCALNET>.28.125':6580
'<LOCALNET>.28.151':6580
'<LOCALNET>.28.137':6580
'<LOCALNET>.28.141':6580
'<LOCALNET>.28.142':6580
'<LOCALNET>.28.143':6580
'<LOCALNET>.28.144':6580
'<LOCALNET>.28.145':6580
'<LOCALNET>.28.146':6580
'<LOCALNET>.28.147':6580
'<LOCALNET>.28.148':6580
'<LOCALNET>.28.149':6580
'<LOCALNET>.28.150':6580
'<LOCALNET>.28.138':6580
'<LOCALNET>.28.139':6580
'<LOCALNET>.28.140':6580
'<LOCALNET>.28.126':6580
'<LOCALNET>.28.189':6580
'<LOCALNET>.28.193':6580
'<LOCALNET>.28.224':6580
'<LOCALNET>.28.225':6580
'<LOCALNET>.28.226':6580
'<LOCALNET>.28.227':6580
'<LOCALNET>.28.228':6580
'<LOCALNET>.28.229':6580
'<LOCALNET>.28.230':6580
'<LOCALNET>.28.231':6580
'<LOCALNET>.28.232':6580
'<LOCALNET>.28.233':6580
'<LOCALNET>.28.221':6580
'<LOCALNET>.28.220':6580
'<LOCALNET>.28.223':6580
'<LOCALNET>.28.234':6580
'<LOCALNET>.28.238':6580
'<LOCALNET>.28.239':6580
'<LOCALNET>.28.240':6580
'<LOCALNET>.28.241':6580
'<LOCALNET>.28.242':6580
'<LOCALNET>.28.243':6580
'<LOCALNET>.28.244':6580
'<LOCALNET>.28.245':6580
'<LOCALNET>.28.246':6580
'<LOCALNET>.28.249':6580
'<LOCALNET>.28.235':6580
'<LOCALNET>.28.236':6580
'<LOCALNET>.28.237':6580
'<LOCALNET>.28.222':6580
'<LOCALNET>.28.190':6580
'<LOCALNET>.28.191':6580
'<LOCALNET>.28.194':6580
'<LOCALNET>.28.195':6580
'<LOCALNET>.28.196':6580
'<LOCALNET>.28.197':6580
'<LOCALNET>.28.198':6580
'<LOCALNET>.28.199':6580
'<LOCALNET>.28.200':6580
'<LOCALNET>.28.201':6580
'<LOCALNET>.28.202':6580
'<LOCALNET>.28.203':6580
'<LOCALNET>.28.219':6580
'<LOCALNET>.28.192':6580
'<LOCALNET>.28.218':6580
'<LOCALNET>.28.204':6580
'<LOCALNET>.28.208':6580
'<LOCALNET>.28.209':6580
'<LOCALNET>.28.210':6580
'<LOCALNET>.28.211':6580
'<LOCALNET>.28.212':6580
'<LOCALNET>.28.213':6580
'<LOCALNET>.28.214':6580
'<LOCALNET>.28.215':6580
'<LOCALNET>.28.250':6580
'<LOCALNET>.28.217':6580
'<LOCALNET>.28.205':6580
'<LOCALNET>.28.206':6580
'<LOCALNET>.28.207':6580
'<LOCALNET>.28.123':6580
'<LOCALNET>.28.216':6580
'<LOCALNET>.28.121':6580
'<LOCALNET>.28.31':6580
'<LOCALNET>.28.32':6580
'<LOCALNET>.28.33':6580
'<LOCALNET>.28.34':6580
'<LOCALNET>.28.35':6580
'<LOCALNET>.28.36':6580
'<LOCALNET>.28.37':6580
'<LOCALNET>.28.38':6580
'<LOCALNET>.28.39':6580
'<LOCALNET>.28.40':6580
'<LOCALNET>.28.41':6580
'<LOCALNET>.28.29':6580
'<LOCALNET>.28.56':6580
'<LOCALNET>.28.28':6580
'<LOCALNET>.28.45':6580
'<LOCALNET>.28.46':6580
'<LOCALNET>.28.47':6580
'<LOCALNET>.28.48':6580
'<LOCALNET>.28.49':6580
'<LOCALNET>.28.50':6580
'<LOCALNET>.28.51':6580
'<LOCALNET>.28.52':6580
'<LOCALNET>.28.53':6580
'<LOCALNET>.28.57':6580
'<LOCALNET>.28.55':6580
'<LOCALNET>.28.43':6580
'<LOCALNET>.28.42':6580
'<LOCALNET>.28.44':6580
'<LOCALNET>.28.54':6580
'<LOCALNET>.28.14':6580
'<LOCALNET>.28.11':6580
'<LOCALNET>.28.10':6580
'<LOCALNET>.28.9':6580
'<LOCALNET>.28.8':6580
'<LOCALNET>.28.7':6580
'<LOCALNET>.28.1':6580
'<LOCALNET>.28.5':6580
'<LOCALNET>.28.4':6580
'<LOCALNET>.28.3':6580
'<LOCALNET>.28.2':6580
'<LOCALNET>.28.27':6580
'<LOCALNET>.28.6':6580
'<LOCALNET>.28.26':6580
'<LOCALNET>.28.12':6580
'<LOCALNET>.28.15':6580
'<LOCALNET>.28.16':6580
'<LOCALNET>.28.17':6580
'<LOCALNET>.28.255':6589
'<LOCALNET>.28.19':6580
'<LOCALNET>.28.20':6580
'<LOCALNET>.28.21':6580
'<LOCALNET>.28.22':6580
'<LOCALNET>.28.23':6580
'<LOCALNET>.28.24':6580
'<LOCALNET>.28.25':6580
'<LOCALNET>.28.13':6580
'<LOCALNET>.28.18':6580
'<LOCALNET>.28.58':6580
'<LOCALNET>.28.98':6580
'<LOCALNET>.28.95':6580
'<LOCALNET>.28.97':6580
'<LOCALNET>.28.30':6580
'<LOCALNET>.28.99':6580
'<LOCALNET>.28.100':6580
'<LOCALNET>.28.101':6580
'<LOCALNET>.28.102':6580
'<LOCALNET>.28.103':6580
'<LOCALNET>.28.104':6580
'<LOCALNET>.28.105':6580
'<LOCALNET>.28.106':6580
'<LOCALNET>.28.94':6580
'<LOCALNET>.28.92':6580
'<LOCALNET>.28.96':6580
'<LOCALNET>.28.107':6580
'<LOCALNET>.28.111':6580
'<LOCALNET>.28.112':6580
'<LOCALNET>.28.113':6580
'<LOCALNET>.28.114':6580
'<LOCALNET>.28.115':6580
'<LOCALNET>.28.116':6580
'<LOCALNET>.28.117':6580
'<LOCALNET>.28.118':6580
'<LOCALNET>.28.119':6580
'<LOCALNET>.28.120':6580
'<LOCALNET>.28.108':6580
'<LOCALNET>.28.109':6580
'<LOCALNET>.28.110':6580
'<LOCALNET>.28.93':6580
'<LOCALNET>.28.87':6580
'<LOCALNET>.28.59':6580
'<LOCALNET>.28.61':6580
'<LOCALNET>.28.62':6580
'<LOCALNET>.28.63':6580
'<LOCALNET>.28.64':6580
'<LOCALNET>.28.65':6580
'<LOCALNET>.28.66':6580
'<LOCALNET>.28.67':6580
'<LOCALNET>.28.68':6580
'<LOCALNET>.28.69':6580
'<LOCALNET>.28.70':6580
'<LOCALNET>.28.71':6580
'<LOCALNET>.28.72':6580
'<LOCALNET>.28.60':6580
'<LOCALNET>.28.73':6580
'<LOCALNET>.28.75':6580
'<LOCALNET>.28.76':6580
'<LOCALNET>.28.77':6580
'<LOCALNET>.28.78':6580
'<LOCALNET>.28.79':6580
'<LOCALNET>.28.80':6580
'<LOCALNET>.28.81':6580
'<LOCALNET>.28.82':6580
'<LOCALNET>.28.83':6580
'<LOCALNET>.28.84':6580
'<LOCALNET>.28.85':6580
'<LOCALNET>.28.86':6580
'<LOCALNET>.28.74':6580
'<LOCALNET>.28.255':6587
'<LOCALNET>.28.100':6583
'<LOCALNET>.28.166':6581
'<LOCALNET>.28.1':6581
'<LOCALNET>.28.165':6581
'<LOCALNET>.28.157':6580
'<LOCALNET>.28.167':6581
'<LOCALNET>.28.168':6581
'<LOCALNET>.28.169':6581
'<LOCALNET>.28.170':6581
'<LOCALNET>.28.171':6581
'<LOCALNET>.28.172':6581
'<LOCALNET>.28.173':6581
'<LOCALNET>.28.174':6581
'<LOCALNET>.28.191':6581
'<LOCALNET>.28.162':6581
'<LOCALNET>.28.164':6581
'<LOCALNET>.28.177':6581
'<LOCALNET>.28.181':6581
'<LOCALNET>.28.182':6581
'<LOCALNET>.28.183':6581
'<LOCALNET>.28.184':6581
'<LOCALNET>.28.185':6581
'<LOCALNET>.28.186':6581
'<LOCALNET>.28.187':6581
'<LOCALNET>.28.188':6581
'<LOCALNET>.28.189':6581
'<LOCALNET>.28.190':6581
'<LOCALNET>.28.175':6581
'<LOCALNET>.28.132':6581
'<LOCALNET>.28.178':6581
'<LOCALNET>.28.192':6581
'<LOCALNET>.28.163':6581
'<LOCALNET>.28.161':6581
'<LOCALNET>.28.135':6581
'<LOCALNET>.28.136':6581
'<LOCALNET>.28.137':6581
'<LOCALNET>.28.138':6581
'<LOCALNET>.28.139':6581
'<LOCALNET>.28.140':6581
'<LOCALNET>.28.141':6581
'<LOCALNET>.28.142':6581
'<LOCALNET>.28.143':6581
'<LOCALNET>.28.144':6581
'<LOCALNET>.28.159':6581
'<LOCALNET>.28.160':6581
'<LOCALNET>.28.176':6581
'<LOCALNET>.28.147':6581
'<LOCALNET>.28.149':6581
'<LOCALNET>.28.150':6581
'<LOCALNET>.28.151':6581
'<LOCALNET>.28.152':6581
'<LOCALNET>.28.153':6581
'<LOCALNET>.28.154':6581
'<LOCALNET>.28.155':6581
'<LOCALNET>.28.156':6581
'<LOCALNET>.28.157':6581
'<LOCALNET>.28.158':6581
'<LOCALNET>.28.145':6581
'<LOCALNET>.28.146':6581
'<LOCALNET>.28.148':6581
'<LOCALNET>.28.134':6581
'<LOCALNET>.28.194':6581
'<LOCALNET>.28.197':6581
'<LOCALNET>.28.233':6581
'<LOCALNET>.28.234':6581
'<LOCALNET>.28.235':6581
'<LOCALNET>.28.236':6581
'<LOCALNET>.28.237':6581
'<LOCALNET>.28.238':6581
'<LOCALNET>.28.239':6581
'<LOCALNET>.28.240':6581
'<LOCALNET>.28.241':6581
'<LOCALNET>.28.242':6581
'<LOCALNET>.28.230':6581
'<LOCALNET>.28.243':6581
'<LOCALNET>.28.232':6581
'<LOCALNET>.28.245':6581
'<LOCALNET>.28.247':6581
'<LOCALNET>.28.248':6581
'<LOCALNET>.28.249':6581
'<LOCALNET>.28.250':6581
'<LOCALNET>.28.251':6581
'<LOCALNET>.28.252':6581
'<LOCALNET>.28.255':6586
'<LOCALNET>.28.254':6581
'<LOCALNET>.28.12':6583
'<LOCALNET>.28.2':6582
'<LOCALNET>.28.244':6581
'<LOCALNET>.28.251':6580
'<LOCALNET>.28.246':6581
'<LOCALNET>.28.196':6581
'<LOCALNET>.28.231':6581
'<LOCALNET>.28.229':6581
'<LOCALNET>.28.198':6581
'<LOCALNET>.28.199':6581
'<LOCALNET>.28.200':6581
'<LOCALNET>.28.201':6581
'<LOCALNET>.28.202':6581
'<LOCALNET>.28.209':6581
'<LOCALNET>.28.210':6581
'<LOCALNET>.28.211':6581
'<LOCALNET>.28.212':6581
'<LOCALNET>.28.228':6581
'<LOCALNET>.28.195':6581
'<LOCALNET>.28.213':6581
'<LOCALNET>.28.193':6581
'<LOCALNET>.28.216':6581
'<LOCALNET>.28.218':6581
'<LOCALNET>.28.219':6581
'<LOCALNET>.28.220':6581
'<LOCALNET>.28.221':6581
'<LOCALNET>.28.222':6581
'<LOCALNET>.28.223':6581
'<LOCALNET>.28.224':6581
'<LOCALNET>.28.225':6581
'<LOCALNET>.28.226':6581
'<LOCALNET>.28.214':6581
'<LOCALNET>.28.215':6581
'<LOCALNET>.28.227':6581
'<LOCALNET>.28.217':6581
'<LOCALNET>.28.133':6581
'<LOCALNET>.28.131':6581
'<LOCALNET>.28.130':6581
'<LOCALNET>.28.37':6581
'<LOCALNET>.28.38':6581
'<LOCALNET>.28.39':6581
'<LOCALNET>.28.40':6581
'<LOCALNET>.28.41':6581
'<LOCALNET>.28.42':6581
'<LOCALNET>.28.43':6581
'<LOCALNET>.28.44':6581
'<LOCALNET>.28.45':6581
'<LOCALNET>.28.46':6581
'<LOCALNET>.28.34':6581
'<LOCALNET>.28.33':6581
'<LOCALNET>.28.36':6581
'<LOCALNET>.28.47':6581
'<LOCALNET>.28.51':6581
'<LOCALNET>.28.52':6581
'<LOCALNET>.28.53':6581
'<LOCALNET>.28.54':6581
'<LOCALNET>.28.55':6581
'<LOCALNET>.28.56':6581
'<LOCALNET>.28.57':6581
'<LOCALNET>.28.58':6581
'<LOCALNET>.28.59':6581
'<LOCALNET>.28.60':6581
'<LOCALNET>.28.48':6581
'<LOCALNET>.28.49':6581
'<LOCALNET>.28.50':6581
'<LOCALNET>.28.35':6581
'<LOCALNET>.28.61':6581
'<LOCALNET>.28.62':6581
'<LOCALNET>.28.2':6581
'<LOCALNET>.28.3':6581
'<LOCALNET>.28.4':6581
'<LOCALNET>.28.5':6581
'<LOCALNET>.28.6':6581
'<LOCALNET>.28.7':6581
'<LOCALNET>.28.8':6581
'<LOCALNET>.28.9':6581
'<LOCALNET>.28.10':6581
'<LOCALNET>.28.11':6581
'<LOCALNET>.28.32':6581
'<LOCALNET>.28.254':6580
'<LOCALNET>.28.31':6581
'<LOCALNET>.28.12':6581
'<LOCALNET>.28.16':6581
'<LOCALNET>.28.17':6581
'<LOCALNET>.28.23':6581
'<LOCALNET>.28.24':6581
'<LOCALNET>.28.25':6581
'<LOCALNET>.28.26':6581
'<LOCALNET>.28.27':6581
'<LOCALNET>.28.28':6581
'<LOCALNET>.28.29':6581
'<LOCALNET>.28.30':6581
'<LOCALNET>.28.13':6581
'<LOCALNET>.28.14':6581
'<LOCALNET>.28.15':6581
'<LOCALNET>.28.63':6581
'<LOCALNET>.28.98':6581
'<LOCALNET>.28.66':6581
'<LOCALNET>.28.101':6581
'<LOCALNET>.28.102':6581
'<LOCALNET>.28.103':6581
'<LOCALNET>.28.104':6581
'<LOCALNET>.28.105':6581
'<LOCALNET>.28.106':6581
'<LOCALNET>.28.107':6581
'<LOCALNET>.28.108':6581
'<LOCALNET>.28.109':6581
'<LOCALNET>.28.97':6581
'<LOCALNET>.28.95':6581
'<LOCALNET>.28.110':6581
'<LOCALNET>.28.100':6581
'<LOCALNET>.28.118':6581
'<LOCALNET>.28.120':6581
'<LOCALNET>.28.121':6581
'<LOCALNET>.28.122':6581
'<LOCALNET>.28.123':6581
'<LOCALNET>.28.124':6581
'<LOCALNET>.28.125':6581
'<LOCALNET>.28.126':6581
'<LOCALNET>.28.127':6581
'<LOCALNET>.28.128':6581
'<LOCALNET>.28.116':6581
'<LOCALNET>.28.117':6581
'<LOCALNET>.28.129':6581
'<LOCALNET>.28.119':6581
'<LOCALNET>.28.99':6581
'<LOCALNET>.28.96':6581
'<LOCALNET>.28.94':6581
'<LOCALNET>.28.67':6581
'<LOCALNET>.28.68':6581
'<LOCALNET>.28.69':6581
'<LOCALNET>.28.70':6581
'<LOCALNET>.28.71':6581
'<LOCALNET>.28.72':6581
'<LOCALNET>.28.73':6581
'<LOCALNET>.28.74':6581
'<LOCALNET>.28.75':6581
'<LOCALNET>.28.76':6581
'<LOCALNET>.28.77':6581
'<LOCALNET>.28.65':6581
'<LOCALNET>.28.78':6581
'<LOCALNET>.28.80':6581
'<LOCALNET>.28.81':6581
'<LOCALNET>.28.82':6581
'<LOCALNET>.28.83':6581
'<LOCALNET>.28.84':6581
'<LOCALNET>.28.85':6581
'<LOCALNET>.28.86':6581
'<LOCALNET>.28.89':6581
'<LOCALNET>.28.90':6581
'<LOCALNET>.28.91':6581
'<LOCALNET>.28.92':6581
'<LOCALNET>.28.93':6581
'<LOCALNET>.28.79':6581
'<LOCALNET>.28.64':6581
'<LOCALNET>.28.253':6580
'<LOCALNET>.28.253':6581

Miscellaneous

Searches for the following windows

ClassName: '2978' WindowName: ''
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: ''
ClassName: 'NotifyIconOverflowWindow' WindowName: ''
ClassName: 'HallMainWnd' WindowName: ''
ClassName: 'jjhgame' WindowName: ''
ClassName: '850GamePlaza' WindowName: ''
ClassName: 'Net77_GamePlaza' WindowName: ''

Creates and executes the following

'%WINDIR%\9775\csrss.exe'
'%WINDIR%\syswow64\wflhul.exe'
'%WINDIR%\9775\mhadj\eqbrm.exe' uid:101286 param:0
'%WINDIR%\9775\agisv\qqfqz.exe' uid:101286 param:58js2135
'%WINDIR%\9775\zklhh\ycyfq.exe' uid:101286 param:0
'%WINDIR%\bmralb.exe'
'%WINDIR%\syswow64\cscript.exe' %WINDIR%\eaoeng.vbs
'%WINDIR%\sbmwne.exe'
'%WINDIR%\9775\zvxrk\igcki.exe' uid:101286 param:|69|70|73
'%WINDIR%\9775\nrtft\mudwe.exe' uid:101286 param:0
'%WINDIR%\9775\csrss.exe' ' (with hidden window)
'%WINDIR%\bmralb.exe' ' (with hidden window)
'%WINDIR%\sbmwne.exe' ' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' %WINDIR%\eaoeng.vbs' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' %WINDIR%\WinCom32.dll /tlb:%WINDIR%\WinCom32.tlb /codebase' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\9775\nrtft\mudwe.exe" >> NUL' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> >> NUL
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\9775\csrss.exe"
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' %WINDIR%\WinCom32.dll /tlb:%WINDIR%\WinCom32.tlb /codebase
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\cmd.exe' cmd /c ping 127.0.0.1 &&cmd /c del "%WINDIR%\9775\nrtft\mudwe.exe" >> NUL
'%WINDIR%\syswow64\cleanmgr.exe'
'%WINDIR%\syswow64\ping.exe' 127.0.0.1

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней