Trojan.DownLoader10.40791

Technical Information

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\FifaAutobuyers.exe' = '%APPDATA%\FifaAutobuyers.exe:*:Enabled:Windows Messanger'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' = '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe:*:Enabled:Windows Messanger'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'

Creates and executes the following:

'%HOMEPATH%\TSJSO\EMNHO.exe' REONZANI.dat
'%HOMEPATH%\TSJSO\EMNHO.exe' 273434.LTG

Executes the following:

'<SYSTEM32>\reg.exe' ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" /t REG_SZ /d "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe:*:Enabled:Windows Messanger" /f
'<SYSTEM32>\reg.exe' ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "%APPDATA%\FifaAutobuyers.exe" /t REG_SZ /d "%APPDATA%\FifaAutobuyers.exe:*:Enabled:Windows Messanger" /f
'<SYSTEM32>\reg.exe' ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
'<SYSTEM32>\wscript.exe' "%HOMEPATH%\TSJSO\3562.vbs" 5240
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'

Injects code into

the following system processes:

%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\TSJSO\54403.NEF
%HOMEPATH%\TSJSO\A73807.TFJ
%HOMEPATH%\TSJSO\66833.KQJ
%HOMEPATH%\TSJSO\19962.KPN
%HOMEPATH%\TSJSO\83224.LPD
%HOMEPATH%\TSJSO\C66837.ARV
%HOMEPATH%\TSJSO\80029.UCH
%HOMEPATH%\TSJSO\43931.QMJ
%HOMEPATH%\TSJSO\69182.XFB
%HOMEPATH%\TSJSO\Q73383.KHG
%HOMEPATH%\TSJSO\49487.RLM
%HOMEPATH%\TSJSO\27840.LMK
%HOMEPATH%\TSJSO\78870.NRU
%HOMEPATH%\TSJSO\33452.XZN
%HOMEPATH%\TSJSO\46384.RZT
%HOMEPATH%\TSJSO\J22333.CMC
%HOMEPATH%\TSJSO\64500.ESM
%HOMEPATH%\TSJSO\C51624.OQJ
%HOMEPATH%\TSJSO\30761.WSV
%HOMEPATH%\TSJSO\40687.LJF
%HOMEPATH%\TSJSO\R15929.ICH
%HOMEPATH%\TSJSO\E26114.WIP
%HOMEPATH%\TSJSO\U26166.GYQ
%HOMEPATH%\TSJSO\U35461.BLH
%HOMEPATH%\TSJSO\P56048.QXR
%HOMEPATH%\TSJSO\Z61162.IBQ
%HOMEPATH%\TSJSO\67793.ODV
%HOMEPATH%\TSJSO\8579.TFO
%HOMEPATH%\TSJSO\77286.YCE
%HOMEPATH%\TSJSO\12490.YRT
%HOMEPATH%\TSJSO\9641.BTR
%HOMEPATH%\TSJSO\23260.HPV
%HOMEPATH%\TSJSO\59520.SEY
%HOMEPATH%\TSJSO\3022.OVO
%HOMEPATH%\TSJSO\V85252.TPV
%HOMEPATH%\TSJSO\76538.YGW
%HOMEPATH%\TSJSO\J92480.QZF
%HOMEPATH%\TSJSO\55369.GXK
%HOMEPATH%\TSJSO\W63782.YUG
%HOMEPATH%\TSJSO\E23933.OPM
%HOMEPATH%\TSJSO\M55184.ZVS
%HOMEPATH%\TSJSO\K96702.FRH
%HOMEPATH%\TSJSO\85648.VFX
%HOMEPATH%\TSJSO\81686.COS
%HOMEPATH%\TSJSO\17111.OFH
%HOMEPATH%\TSJSO\50640.TJB
%HOMEPATH%\TSJSO\E26314.EFM
%HOMEPATH%\TSJSO\34427.RXL
%HOMEPATH%\TSJSO\77713.KVV
%HOMEPATH%\TSJSO\U32039.VWR
%HOMEPATH%\TSJSO\V98094.ZBZ
%HOMEPATH%\TSJSO\F34514.ZOM
%HOMEPATH%\TSJSO\P33126.DOV
%HOMEPATH%\TSJSO\I5666.WFA
%HOMEPATH%\TSJSO\72887.AFQ
%HOMEPATH%\TSJSO\V48482.HKN
%HOMEPATH%\TSJSO\91334.WEA
%HOMEPATH%\TSJSO\Y45482.YAI
%HOMEPATH%\TSJSO\3957.BUS
%HOMEPATH%\TSJSO\I65054.MST
%HOMEPATH%\TSJSO\N98633.RIE
%HOMEPATH%\TSJSO\M18285.KRM
%HOMEPATH%\TSJSO\25144.GUF
%HOMEPATH%\TSJSO\G45150.YGG
%HOMEPATH%\TSJSO\30108.LWS
%HOMEPATH%\TSJSO\42359.TRV
%HOMEPATH%\TSJSO\76314.BPC
%HOMEPATH%\TSJSO\R75520.RVY
%HOMEPATH%\TSJSO\15446.HBR
%HOMEPATH%\TSJSO\31452.VER
%HOMEPATH%\TSJSO\Z80472.XTL
%HOMEPATH%\TSJSO\J87779.BMK
%HOMEPATH%\TSJSO\10073.UHU
%HOMEPATH%\TSJSO\36046.NML
%HOMEPATH%\TSJSO\W49180.SSZ
%HOMEPATH%\TSJSO\66143.VUY
%HOMEPATH%\TSJSO\U66799.ZKB
%HOMEPATH%\TSJSO\55939.VDR
%HOMEPATH%\TSJSO\52318.NBB
%HOMEPATH%\TSJSO\92370.OZS
%HOMEPATH%\TSJSO\54741.SQS
%HOMEPATH%\TSJSO\57341.VQS
%HOMEPATH%\TSJSO\O21480.WKB
%HOMEPATH%\TSJSO\62594.KSD
%HOMEPATH%\TSJSO\I10475.HWN
%HOMEPATH%\TSJSO\39444.JZV
%HOMEPATH%\TSJSO\K4084.LNJ
%HOMEPATH%\TSJSO\G75165.WUS
%HOMEPATH%\TSJSO\85425.ZIL
%HOMEPATH%\TSJSO\F44445.JAX
%HOMEPATH%\TSJSO\K94004.JEL
%HOMEPATH%\TSJSO\88690.OXI
%HOMEPATH%\TSJSO\E89190.QQN
%HOMEPATH%\TSJSO\P61067.CCA
%HOMEPATH%\TSJSO\98860.GGD
%HOMEPATH%\TSJSO\E85641.XQH
%HOMEPATH%\TSJSO\M27723.QQM
%HOMEPATH%\TSJSO\A74797.OPG
%HOMEPATH%\TSJSO\90361.VNA
%HOMEPATH%\TSJSO\Z7017.JJT
%HOMEPATH%\TSJSO\44608.FYU
%HOMEPATH%\TSJSO\75498.OEL
%HOMEPATH%\TSJSO\2331.BKD
%HOMEPATH%\TSJSO\5530.VUP
%HOMEPATH%\TSJSO\O64994.OJB
%HOMEPATH%\TSJSO\L88714.KBH
%HOMEPATH%\TSJSO\4987.UJB
%HOMEPATH%\TSJSO\S61901.DNT
%HOMEPATH%\TSJSO\94481.YIZ
%HOMEPATH%\TSJSO\24644.EDB
%HOMEPATH%\TSJSO\32804.YNI
%HOMEPATH%\TSJSO\2608.XAE
%HOMEPATH%\TSJSO\X92589.BDT
%HOMEPATH%\TSJSO\X6110.HET
%HOMEPATH%\TSJSO\F65070.NEV
%HOMEPATH%\TSJSO\B37161.GBU
%HOMEPATH%\TSJSO\A45378.TKR
%HOMEPATH%\TSJSO\45773.YMF
%HOMEPATH%\TSJSO\88271.OAH
%HOMEPATH%\TSJSO\57034.JTY
%HOMEPATH%\TSJSO\93221.TKD
%HOMEPATH%\TSJSO\D71086.YMT
%HOMEPATH%\TSJSO\34982.YHV
%HOMEPATH%\TSJSO\59690.JUN
%HOMEPATH%\TSJSO\51357.TVI
%HOMEPATH%\TSJSO\O90072.NGM
%HOMEPATH%\TSJSO\79020.LVL
%HOMEPATH%\TSJSO\X55945.MCB
%HOMEPATH%\TSJSO\24080.MDJ
%HOMEPATH%\TSJSO\72231.SRU
%HOMEPATH%\TSJSO\E17063.IIW
%HOMEPATH%\TSJSO\U50479.LDV
%HOMEPATH%\TSJSO\96386.DUH
%HOMEPATH%\TSJSO\Z40212.TYL
%HOMEPATH%\TSJSO\E72255.WCU
%HOMEPATH%\TSJSO\51244.ENK
%HOMEPATH%\TSJSO\M79031.UBU
%HOMEPATH%\TSJSO\43701.OLW
%HOMEPATH%\TSJSO\59469.RVO
%HOMEPATH%\TSJSO\61880.PKJ
%HOMEPATH%\TSJSO\94092.HSB
%HOMEPATH%\TSJSO\Z95876.FLA
%HOMEPATH%\TSJSO\25810.QYW
%HOMEPATH%\TSJSO\86035.WGU
%HOMEPATH%\TSJSO\40104.YTN
%HOMEPATH%\TSJSO\28391.JDZ
%HOMEPATH%\TSJSO\53051.ICY
%HOMEPATH%\TSJSO\76774.FRH
%HOMEPATH%\TSJSO\34717.VKL
%HOMEPATH%\TSJSO\N95420.KWB
%HOMEPATH%\TSJSO\C80688.RFY
%HOMEPATH%\TSJSO\62969.JAY
%HOMEPATH%\TSJSO\98675.KDI
%HOMEPATH%\TSJSO\D61880.SAL
%HOMEPATH%\TSJSO\U61218.GMP
%HOMEPATH%\TSJSO\T53111.FBH
%HOMEPATH%\TSJSO\38542.CJN
%HOMEPATH%\TSJSO\90897.NBG
%HOMEPATH%\TSJSO\Z3370.TNT
%HOMEPATH%\TSJSO\S36149.HIQ
%HOMEPATH%\TSJSO\I12948.XRJ
%HOMEPATH%\TSJSO\I84717.TTH
%HOMEPATH%\TSJSO\W47438.GDG
%HOMEPATH%\TSJSO\A32950.WSL
%HOMEPATH%\TSJSO\H40485.RQH
%HOMEPATH%\TSJSO\W8434.OFH
%HOMEPATH%\TSJSO\73592.YYI
%HOMEPATH%\TSJSO\37252.YIW
%HOMEPATH%\TSJSO\64023.XYF
%HOMEPATH%\TSJSO\Y48904.CHE
%HOMEPATH%\TSJSO\19162.LWY
%HOMEPATH%\TSJSO\Q27102.JCP
%HOMEPATH%\TSJSO\C18842.VRR
%HOMEPATH%\TSJSO\S58224.WUL
%HOMEPATH%\TSJSO\64685.NSA
%HOMEPATH%\TSJSO\E93516.IND
%HOMEPATH%\TSJSO\N42079.LFS
%HOMEPATH%\TSJSO\83209.LZE
%HOMEPATH%\TSJSO\S67189.WRG
%HOMEPATH%\TSJSO\E63097.KBQ
%HOMEPATH%\TSJSO\52046.TSU
%HOMEPATH%\TSJSO\G55492.EBK
%HOMEPATH%\TSJSO\Q48915.XPH
%HOMEPATH%\TSJSO\Z29352.IFX
%HOMEPATH%\TSJSO\71978.ALF
%HOMEPATH%\TSJSO\49444.PRX
%HOMEPATH%\TSJSO\E50107.HVB
%HOMEPATH%\TSJSO\78015.ODE
%HOMEPATH%\TSJSO\16519.UHM
%HOMEPATH%\TSJSO\65955.PHX
%HOMEPATH%\TSJSO\V35901.SEO
%HOMEPATH%\TSJSO\25628.CDI
%HOMEPATH%\TSJSO\82239.JHH
%HOMEPATH%\TSJSO\91267.QKU
%HOMEPATH%\TSJSO\REONZANI.dat
%HOMEPATH%\TSJSO\F62077.USA
%APPDATA%\ScannerS
%APPDATA%\FifaAutobuyers.exe
%HOMEPATH%\TSJSO\D80391.DBC
%HOMEPATH%\TSJSO\P79375.CXX
%HOMEPATH%\TSJSO\M93573.XAV
%HOMEPATH%\TSJSO\P71761.ZYI
%HOMEPATH%\TSJSO\96591.LXC
%HOMEPATH%\TSJSO\P49369.JMK
%HOMEPATH%\TSJSO\X88116.UTO
%HOMEPATH%\TSJSO\G1033.IQM
%HOMEPATH%\TSJSO\9499.GQE
%HOMEPATH%\TSJSO\W99271.PSO
%HOMEPATH%\TSJSO\90636.LSP
%HOMEPATH%\TSJSO\5454.GKL
%HOMEPATH%\TSJSO\Z17691.TGC
%HOMEPATH%\TSJSO\H49897.OYW
%HOMEPATH%\TSJSO\V90673.INB
%HOMEPATH%\TSJSO\47269.KUG
%HOMEPATH%\TSJSO\O98894.DEM
%HOMEPATH%\TSJSO\93532.YUU
%HOMEPATH%\TSJSO\9731.YZV
%HOMEPATH%\TSJSO\41471.OLR
%HOMEPATH%\TSJSO\I17120.SET
%HOMEPATH%\TSJSO\J42991.EII
%HOMEPATH%\TSJSO\H6496.UEQ
%HOMEPATH%\TSJSO\83391.YCA
%HOMEPATH%\TSJSO\N7145.HZQ
%HOMEPATH%\TSJSO\21380.MEY
%HOMEPATH%\TSJSO\24165.BWN
%HOMEPATH%\TSJSO\W28911.VKU
%HOMEPATH%\TSJSO\48404.WKQ
%HOMEPATH%\TSJSO\I30886.SUO
%HOMEPATH%\TSJSO\E14595.HKO
%HOMEPATH%\TSJSO\L57987.VGY
%HOMEPATH%\TSJSO\R3480.LVT
%HOMEPATH%\TSJSO\89841.UFZ
%HOMEPATH%\TSJSO\F49193.GBJ
%HOMEPATH%\TSJSO\I15753.QGM
%HOMEPATH%\TSJSO\L72415.IJQ
%HOMEPATH%\TSJSO\B67744.DXN
%HOMEPATH%\TSJSO\75968.TIH
%HOMEPATH%\TSJSO\D83708.UBE
%HOMEPATH%\TSJSO\51659.AIO
%HOMEPATH%\TSJSO\O5618.NZT
%HOMEPATH%\TSJSO\N60366.ZOZ
%HOMEPATH%\TSJSO\9305.FRF
%HOMEPATH%\TSJSO\T15129.ABZ
%HOMEPATH%\TSJSO\Y3363.HNI
%HOMEPATH%\TSJSO\Q93351.DTY
%HOMEPATH%\TSJSO\89946.PHW
%HOMEPATH%\TSJSO\F1186.YPO
%HOMEPATH%\TSJSO\50925.SBC
%HOMEPATH%\TSJSO\15948.BJT
%HOMEPATH%\TSJSO\V86204.SPE
%HOMEPATH%\TSJSO\51271.MTC
%HOMEPATH%\TSJSO\M79193.ABP
%HOMEPATH%\TSJSO\22347.KCR
%HOMEPATH%\TSJSO\81073.ESG
%HOMEPATH%\TSJSO\G85919.JAE
%HOMEPATH%\TSJSO\X35322.IZI
%HOMEPATH%\TSJSO\24266.GPT
%HOMEPATH%\TSJSO\I78555.KEX
%HOMEPATH%\TSJSO\94951.LQZ
%HOMEPATH%\TSJSO\89211.TXW
%HOMEPATH%\TSJSO\50575.LGX
%HOMEPATH%\TSJSO\43746.SED
%HOMEPATH%\TSJSO\T87601.PKB
%HOMEPATH%\TSJSO\F64902.CUJ
%HOMEPATH%\TSJSO\I68160.MLA
%HOMEPATH%\TSJSO\8444.PLA
%HOMEPATH%\TSJSO\O69672.AND
%HOMEPATH%\TSJSO\Q86417.FQS
%HOMEPATH%\TSJSO\H35668.VDD
%HOMEPATH%\TSJSO\V86679.MDP
%HOMEPATH%\TSJSO\23360.RXA
%HOMEPATH%\TSJSO\94166.MNF
%HOMEPATH%\TSJSO\34159.YQQ
%HOMEPATH%\TSJSO\K40862.EPY
%HOMEPATH%\TSJSO\36005.GLM
%HOMEPATH%\TSJSO\F13176.ALI
%HOMEPATH%\TSJSO\58154.XNW
%HOMEPATH%\TSJSO\58712.JQW
%HOMEPATH%\TSJSO\H17363.AXY
%HOMEPATH%\TSJSO\69564.GQP
%HOMEPATH%\TSJSO\W80582.CFN
%HOMEPATH%\TSJSO\A80603.XQH
%HOMEPATH%\TSJSO\13280.QAJ
%HOMEPATH%\TSJSO\K34475.QID
%HOMEPATH%\TSJSO\H83871.VTL
%HOMEPATH%\TSJSO\55739.SXA
%HOMEPATH%\TSJSO\64151.RNX
%HOMEPATH%\TSJSO\H89096.MCS
%HOMEPATH%\TSJSO\C20290.HXH
%HOMEPATH%\TSJSO\93252.MZQ
%HOMEPATH%\TSJSO\A3194.PEG
%HOMEPATH%\TSJSO\88983.IUC
%HOMEPATH%\TSJSO\P61429.UFG
%HOMEPATH%\TSJSO\C62458.DRF
%HOMEPATH%\TSJSO\U96176.PUS
%HOMEPATH%\TSJSO\3390.QKO
%HOMEPATH%\TSJSO\C68174.WWM
%HOMEPATH%\TSJSO\O96523.ACZ
%HOMEPATH%\TSJSO\Z7178.QMZ
%HOMEPATH%\TSJSO\U24015.LES
%HOMEPATH%\TSJSO\O84220.PEH
%HOMEPATH%\TSJSO\23367.FGQ
%HOMEPATH%\TSJSO\P95836.XEL
%HOMEPATH%\TSJSO\V22597.XUX
%HOMEPATH%\TSJSO\Y85569.XKU
%HOMEPATH%\TSJSO\32348.ODZ
%HOMEPATH%\TSJSO\T31170.KIX
%HOMEPATH%\TSJSO\32983.ABZ
%HOMEPATH%\TSJSO\42144.BAG
%HOMEPATH%\TSJSO\W34118.QNH
%HOMEPATH%\TSJSO\G57987.FTN
%HOMEPATH%\TSJSO\Z16922.GZE
%HOMEPATH%\TSJSO\13372.QLU
%HOMEPATH%\TSJSO\64358.ZEN
%HOMEPATH%\TSJSO\17113.ZHV
%HOMEPATH%\TSJSO\62063.GHF
%HOMEPATH%\TSJSO\M1970.BIJ
%HOMEPATH%\TSJSO\39122.QYR
%HOMEPATH%\TSJSO\60169.DKX
%HOMEPATH%\TSJSO\V56675.IFO
%HOMEPATH%\TSJSO\8895.RXZ
%HOMEPATH%\TSJSO\59707.NJR
%HOMEPATH%\TSJSO\34295.MKR
%HOMEPATH%\TSJSO\C71790.ISY
%HOMEPATH%\TSJSO\I32357.PVL
%HOMEPATH%\TSJSO\73758.NOH
%HOMEPATH%\TSJSO\74915.LCT
%HOMEPATH%\TSJSO\26795.FHB
%HOMEPATH%\TSJSO\K67390.UCA
%HOMEPATH%\TSJSO\X26147.GTC
%HOMEPATH%\TSJSO\Y94179.SNG
%HOMEPATH%\TSJSO\3467.TLK
%HOMEPATH%\TSJSO\B85260.WVI
%HOMEPATH%\TSJSO\S1526.WQN
%HOMEPATH%\TSJSO\H11099.FEZ
%HOMEPATH%\TSJSO\Z5380.ZJW
%HOMEPATH%\TSJSO\O23556.NYC
%HOMEPATH%\TSJSO\88055.QAA
%HOMEPATH%\TSJSO\H92527.OCP
%HOMEPATH%\TSJSO\66496.QTJ
%HOMEPATH%\TSJSO\99436.MZU
%HOMEPATH%\TSJSO\39262.WHK
%HOMEPATH%\TSJSO\95308.GNE
%HOMEPATH%\TSJSO\E2341.GHE
%HOMEPATH%\TSJSO\O62764.EME
%HOMEPATH%\TSJSO\P9990.GMI
%HOMEPATH%\TSJSO\A4668.IAV
%HOMEPATH%\TSJSO\Z85217.AQF
%HOMEPATH%\TSJSO\T76474.BRK
%HOMEPATH%\TSJSO\V52971.MCA
%HOMEPATH%\TSJSO\Q95706.JIT
%HOMEPATH%\TSJSO\H66089.GGY
%HOMEPATH%\TSJSO\97922.VYN
%HOMEPATH%\TSJSO\Z89788.OUI
%HOMEPATH%\TSJSO\46077.WWW
%HOMEPATH%\TSJSO\93137.ZTN
%HOMEPATH%\TSJSO\78239.ZQK
%HOMEPATH%\TSJSO\T38211.GKN
%HOMEPATH%\TSJSO\D69106.OUT
%HOMEPATH%\TSJSO\40723.PET
%HOMEPATH%\TSJSO\F83048.VGQ
%HOMEPATH%\TSJSO\72261.UNM
%HOMEPATH%\TSJSO\70814.JXP
%HOMEPATH%\TSJSO\45617.PQG
%HOMEPATH%\TSJSO\96952.SJX
%HOMEPATH%\TSJSO\10249.DHB
%HOMEPATH%\TSJSO\D1806.XMG
%HOMEPATH%\TSJSO\V51101.KFA
%HOMEPATH%\TSJSO\V26856.JCN
%HOMEPATH%\TSJSO\B66078.BNP
%HOMEPATH%\TSJSO\35744.ZXJ
%HOMEPATH%\TSJSO\T1762.MTU
%HOMEPATH%\TSJSO\R93188.YDK
%HOMEPATH%\TSJSO\J89294.JYS
%HOMEPATH%\TSJSO\Z89346.GPR
%HOMEPATH%\TSJSO\W94384.CIN
%HOMEPATH%\TSJSO\L17194.HOM
%HOMEPATH%\TSJSO\Q17019.YAI
%HOMEPATH%\TSJSO\Y77577.ZRQ
%HOMEPATH%\TSJSO\63818.ITL
%HOMEPATH%\TSJSO\94014.MKJ
%HOMEPATH%\TSJSO\L8968.JQE
%HOMEPATH%\TSJSO\B92674.OKJ
%HOMEPATH%\TSJSO\D80357.TCQ
%HOMEPATH%\TSJSO\Y40016.KMY
%HOMEPATH%\TSJSO\M1457.HGY
%HOMEPATH%\TSJSO\79314.JMQ
%HOMEPATH%\TSJSO\16434.RUM
%HOMEPATH%\TSJSO\45987.FLY
%HOMEPATH%\TSJSO\R98086.QKT
%HOMEPATH%\TSJSO\3562.vbs
%HOMEPATH%\TSJSO\18740.OVJ
%HOMEPATH%\TSJSO\37783.STE
%HOMEPATH%\TSJSO\settings.ini
%HOMEPATH%\TSJSO\722439.dat
%HOMEPATH%\TSJSO\273434.LTG
%HOMEPATH%\TSJSO\EMNHO.exe
%HOMEPATH%\TSJSO\159719.dat
%HOMEPATH%\TSJSO\E92329.FBY
%HOMEPATH%\TSJSO\V30328.PIM
%HOMEPATH%\TSJSO\P98551.RMF
%HOMEPATH%\TSJSO\67632.KMP
%HOMEPATH%\TSJSO\46315.GNT
%HOMEPATH%\TSJSO\26021.LWV
%HOMEPATH%\TSJSO\H39532.LLB
%HOMEPATH%\TSJSO\N48084.PMV
%HOMEPATH%\TSJSO\C50996.SBA
%HOMEPATH%\TSJSO\96589.IMZ
%HOMEPATH%\TSJSO\71047.XQF
%HOMEPATH%\TSJSO\I55575.NME
%HOMEPATH%\TSJSO\79573.ZFL
%HOMEPATH%\TSJSO\17575.UFW
%HOMEPATH%\TSJSO\56704.TWR
%HOMEPATH%\TSJSO\L7240.FJY
%HOMEPATH%\TSJSO\X31325.EDX
%HOMEPATH%\TSJSO\P70948.HFC
%HOMEPATH%\TSJSO\33694.DYE
%HOMEPATH%\TSJSO\81522.ZBM
%HOMEPATH%\TSJSO\W82580.BHR
%HOMEPATH%\TSJSO\17226.EPL
%HOMEPATH%\TSJSO\Q33001.FES
%HOMEPATH%\TSJSO\W61682.WOL
%HOMEPATH%\TSJSO\K82224.MUA
%HOMEPATH%\TSJSO\56728.IJX
%HOMEPATH%\TSJSO\M73239.CJN
%HOMEPATH%\TSJSO\90789.PHA
%HOMEPATH%\TSJSO\22764.JTI
%HOMEPATH%\TSJSO\25657.VTD
%HOMEPATH%\TSJSO\53415.AGF
%HOMEPATH%\TSJSO\16089.DVQ
%HOMEPATH%\TSJSO\87886.XLT
%HOMEPATH%\TSJSO\15534.PZT
%HOMEPATH%\TSJSO\77023.FOT
%HOMEPATH%\TSJSO\91050.ONF
%HOMEPATH%\TSJSO\Z55669.GOP
%HOMEPATH%\TSJSO\58998.MUX
%HOMEPATH%\TSJSO\45336.NPU
%HOMEPATH%\TSJSO\98696.MGU
%HOMEPATH%\TSJSO\23472.WTN
%HOMEPATH%\TSJSO\V35077.BVA
%HOMEPATH%\TSJSO\Q89330.BSQ
%HOMEPATH%\TSJSO\23887.FWP
%HOMEPATH%\TSJSO\S55778.KOO
%HOMEPATH%\TSJSO\A82167.VIU
%HOMEPATH%\TSJSO\83312.QPQ
%HOMEPATH%\TSJSO\32113.KLU
%HOMEPATH%\TSJSO\88458.UOX
%HOMEPATH%\TSJSO\14822.ZNK
%HOMEPATH%\TSJSO\X75108.QLX
%HOMEPATH%\TSJSO\X99624.XMR
%HOMEPATH%\TSJSO\94772.BDS
%HOMEPATH%\TSJSO\Y20802.JAY
%HOMEPATH%\TSJSO\K44064.BEW
%HOMEPATH%\TSJSO\59845.AZP
%HOMEPATH%\TSJSO\26572.WLH
%HOMEPATH%\TSJSO\76324.XME
%HOMEPATH%\TSJSO\37459.RGG
%HOMEPATH%\TSJSO\D26175.SMM
%HOMEPATH%\TSJSO\B54214.XLO
%HOMEPATH%\TSJSO\95013.ZKA
%HOMEPATH%\TSJSO\42592.OHM
%HOMEPATH%\TSJSO\49013.WNN
%HOMEPATH%\TSJSO\7467.FPJ
%HOMEPATH%\TSJSO\46504.OOW
%HOMEPATH%\TSJSO\K15597.GPD
%HOMEPATH%\TSJSO\79736.JEP
%HOMEPATH%\TSJSO\O74740.DZU
%HOMEPATH%\TSJSO\31909.TGZ
%HOMEPATH%\TSJSO\V34205.JMY
%HOMEPATH%\TSJSO\22667.CCQ
%HOMEPATH%\TSJSO\68723.URA
%HOMEPATH%\TSJSO\80899.NMI
%HOMEPATH%\TSJSO\X99528.KCE
%HOMEPATH%\TSJSO\9667.FZJ
%HOMEPATH%\TSJSO\R21466.GXG
%HOMEPATH%\TSJSO\I62340.RNV
%HOMEPATH%\TSJSO\56379.CKR
%HOMEPATH%\TSJSO\45286.QAY
%HOMEPATH%\TSJSO\B69284.JCN
%HOMEPATH%\TSJSO\L12021.WWW
%HOMEPATH%\TSJSO\12053.DNF
%HOMEPATH%\TSJSO\N86163.CCV
%HOMEPATH%\TSJSO\18402.WHK
%HOMEPATH%\TSJSO\S98100.AXM
%HOMEPATH%\TSJSO\54539.DUK
%HOMEPATH%\TSJSO\38263.RHI
%HOMEPATH%\TSJSO\N54395.FYE
%HOMEPATH%\TSJSO\W71517.TXS
%HOMEPATH%\TSJSO\N87382.LNF
%HOMEPATH%\TSJSO\X38364.XPW
%HOMEPATH%\TSJSO\I44039.YGT
%HOMEPATH%\TSJSO\94601.PZV
%HOMEPATH%\TSJSO\71082.OGQ
%HOMEPATH%\TSJSO\79550.WVL
%HOMEPATH%\TSJSO\45846.NSY
%HOMEPATH%\TSJSO\G78115.LTX
%HOMEPATH%\TSJSO\G40490.AUR
%HOMEPATH%\TSJSO\X10879.HMX
%HOMEPATH%\TSJSO\C44672.YSN
%HOMEPATH%\TSJSO\A62090.PIR
%HOMEPATH%\TSJSO\11910.IPA
%HOMEPATH%\TSJSO\P13968.MUN
%HOMEPATH%\TSJSO\15556.TET
%HOMEPATH%\TSJSO\95510.TDC
%HOMEPATH%\TSJSO\Z60128.ULZ
%HOMEPATH%\TSJSO\1229.XIA
%HOMEPATH%\TSJSO\29048.ZVE
%HOMEPATH%\TSJSO\99537.UWB
%HOMEPATH%\TSJSO\G70451.QSH
%HOMEPATH%\TSJSO\20589.JGK
%HOMEPATH%\TSJSO\K86335.XLO
%HOMEPATH%\TSJSO\14215.ARX
%HOMEPATH%\TSJSO\R89682.SKH
%HOMEPATH%\TSJSO\C28620.KKE
%HOMEPATH%\TSJSO\E71793.DJJ
%HOMEPATH%\TSJSO\49637.YHV
%HOMEPATH%\TSJSO\Q50874.UYJ
%HOMEPATH%\TSJSO\A20854.HKQ
%HOMEPATH%\TSJSO\97206.ANS
%HOMEPATH%\TSJSO\W7209.RRO
%HOMEPATH%\TSJSO\H65244.NEZ
%HOMEPATH%\TSJSO\45155.BTW
%HOMEPATH%\TSJSO\66744.THK
%HOMEPATH%\TSJSO\L53352.LTQ
%HOMEPATH%\TSJSO\G60137.CEA
%HOMEPATH%\TSJSO\33361.DYA
%HOMEPATH%\TSJSO\80996.ACB
%HOMEPATH%\TSJSO\80912.FUD
%HOMEPATH%\TSJSO\34958.ORB
%HOMEPATH%\TSJSO\K83366.XRB
%HOMEPATH%\TSJSO\83295.DED
%HOMEPATH%\TSJSO\99884.SFI
%HOMEPATH%\TSJSO\Q45170.NTY
%HOMEPATH%\TSJSO\58404.VKQ
%HOMEPATH%\TSJSO\17006.PZW
%HOMEPATH%\TSJSO\17696.TGT
%HOMEPATH%\TSJSO\D44956.XPV
%HOMEPATH%\TSJSO\9480.FUU
%HOMEPATH%\TSJSO\58558.FIQ
%HOMEPATH%\TSJSO\90016.KMD
%HOMEPATH%\TSJSO\V71552.IQZ
%HOMEPATH%\TSJSO\6170.IKV
%HOMEPATH%\TSJSO\Z79951.YJP
%HOMEPATH%\TSJSO\X34580.UXN
%HOMEPATH%\TSJSO\D29495.TNA
%HOMEPATH%\TSJSO\I39152.ZMT
%HOMEPATH%\TSJSO\H88928.UED
%HOMEPATH%\TSJSO\Q22044.UIS
%HOMEPATH%\TSJSO\Q72669.UZQ
%HOMEPATH%\TSJSO\O82076.TIS
%HOMEPATH%\TSJSO\Z68506.FGO
%HOMEPATH%\TSJSO\X62517.DFP
%HOMEPATH%\TSJSO\46820.WCE
%HOMEPATH%\TSJSO\91900.PUZ
%HOMEPATH%\TSJSO\75921.XSU
%HOMEPATH%\TSJSO\75595.SHK
%HOMEPATH%\TSJSO\32898.VKI
%HOMEPATH%\TSJSO\10541.YAJ
%HOMEPATH%\TSJSO\S34052.NCG
%HOMEPATH%\TSJSO\M94597.HCG
%HOMEPATH%\TSJSO\A56880.XRH
%HOMEPATH%\TSJSO\65448.JXR
%HOMEPATH%\TSJSO\O72271.OPZ
%HOMEPATH%\TSJSO\F10390.SBY
%HOMEPATH%\TSJSO\70533.NFY
%HOMEPATH%\TSJSO\U39085.TLA
%HOMEPATH%\TSJSO\O56932.UQS
%HOMEPATH%\TSJSO\18526.ZXK
%HOMEPATH%\TSJSO\31189.QHE
%HOMEPATH%\TSJSO\N57254.LFZ
%HOMEPATH%\TSJSO\B98708.PXK
%HOMEPATH%\TSJSO\K88486.PUN
%HOMEPATH%\TSJSO\6767.COZ
%HOMEPATH%\TSJSO\2518.RZN
%HOMEPATH%\TSJSO\G68193.PQN
%HOMEPATH%\TSJSO\3183.EPD
%HOMEPATH%\TSJSO\58387.ZTS
%HOMEPATH%\TSJSO\87618.OEG
%HOMEPATH%\TSJSO\39291.PMP
%HOMEPATH%\TSJSO\R16314.ZRN
%HOMEPATH%\TSJSO\97114.FUQ
%HOMEPATH%\TSJSO\P3821.PXA
%HOMEPATH%\TSJSO\Z23889.CLN
%HOMEPATH%\TSJSO\B57495.UUJ
%HOMEPATH%\TSJSO\56133.RBP
%HOMEPATH%\TSJSO\V21650.SGZ
%HOMEPATH%\TSJSO\X65095.ZWU
%HOMEPATH%\TSJSO\G35130.GAM
%HOMEPATH%\TSJSO\39667.SAO
%HOMEPATH%\TSJSO\C3411.FKH
%HOMEPATH%\TSJSO\55575.FDZ
%HOMEPATH%\TSJSO\65809.PUU

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\TSJSO\83224.LPD
%HOMEPATH%\TSJSO\43931.QMJ
%HOMEPATH%\TSJSO\54403.NEF
%HOMEPATH%\TSJSO\A73807.TFJ
%HOMEPATH%\TSJSO\69182.XFB
%HOMEPATH%\TSJSO\30761.WSV
%HOMEPATH%\TSJSO\9641.BTR
%HOMEPATH%\TSJSO\C66837.ARV
%HOMEPATH%\TSJSO\80029.UCH
%HOMEPATH%\TSJSO\33452.XZN
%HOMEPATH%\TSJSO\64500.ESM
%HOMEPATH%\TSJSO\Q73383.KHG
%HOMEPATH%\TSJSO\49487.RLM
%HOMEPATH%\TSJSO\C51624.OQJ
%HOMEPATH%\TSJSO\66833.KQJ
%HOMEPATH%\TSJSO\19962.KPN
%HOMEPATH%\TSJSO\46384.RZT
%HOMEPATH%\TSJSO\J22333.CMC
%HOMEPATH%\TSJSO\R15929.ICH
%HOMEPATH%\TSJSO\U35461.BLH
%HOMEPATH%\TSJSO\U26166.GYQ
%HOMEPATH%\TSJSO\40687.LJF
%HOMEPATH%\TSJSO\67793.ODV
%HOMEPATH%\TSJSO\Z61162.IBQ
%HOMEPATH%\TSJSO\34982.YHV
%HOMEPATH%\TSJSO\8579.TFO
%HOMEPATH%\TSJSO\P56048.QXR
%HOMEPATH%\TSJSO\12490.YRT
%HOMEPATH%\TSJSO\59520.SEY
%HOMEPATH%\TSJSO\23260.HPV
%HOMEPATH%\TSJSO\77286.YCE
%HOMEPATH%\TSJSO\76538.YGW
%HOMEPATH%\TSJSO\V85252.TPV
%HOMEPATH%\TSJSO\E26114.WIP
%HOMEPATH%\TSJSO\J92480.QZF
%HOMEPATH%\TSJSO\3022.OVO
%HOMEPATH%\TSJSO\78870.NRU
%HOMEPATH%\TSJSO\K96702.FRH
%HOMEPATH%\TSJSO\17111.OFH
%HOMEPATH%\TSJSO\55369.GXK
%HOMEPATH%\TSJSO\W63782.YUG
%HOMEPATH%\TSJSO\50640.TJB
%HOMEPATH%\TSJSO\V48482.HKN
%HOMEPATH%\TSJSO\R75520.RVY
%HOMEPATH%\TSJSO\85648.VFX
%HOMEPATH%\TSJSO\81686.COS
%HOMEPATH%\TSJSO\V98094.ZBZ
%HOMEPATH%\TSJSO\I5666.WFA
%HOMEPATH%\TSJSO\E26314.EFM
%HOMEPATH%\TSJSO\34427.RXL
%HOMEPATH%\TSJSO\72887.AFQ
%HOMEPATH%\TSJSO\E23933.OPM
%HOMEPATH%\TSJSO\M55184.ZVS
%HOMEPATH%\TSJSO\F34514.ZOM
%HOMEPATH%\TSJSO\P33126.DOV
%HOMEPATH%\TSJSO\Y45482.YAI
%HOMEPATH%\TSJSO\N98633.RIE
%HOMEPATH%\TSJSO\I65054.MST
%HOMEPATH%\TSJSO\91334.WEA
%HOMEPATH%\TSJSO\G45150.YGG
%HOMEPATH%\TSJSO\25144.GUF
%HOMEPATH%\TSJSO\27840.LMK
%HOMEPATH%\TSJSO\30108.LWS
%HOMEPATH%\TSJSO\M18285.KRM
%HOMEPATH%\TSJSO\76314.BPC
%HOMEPATH%\TSJSO\31452.VER
%HOMEPATH%\TSJSO\15446.HBR
%HOMEPATH%\TSJSO\42359.TRV
%HOMEPATH%\TSJSO\10073.UHU
%HOMEPATH%\TSJSO\J87779.BMK
%HOMEPATH%\TSJSO\3957.BUS
%HOMEPATH%\TSJSO\36046.NML
%HOMEPATH%\TSJSO\Z80472.XTL
%HOMEPATH%\TSJSO\59690.JUN
%HOMEPATH%\TSJSO\52318.NBB
%HOMEPATH%\TSJSO\57341.VQS
%HOMEPATH%\TSJSO\W49180.SSZ
%HOMEPATH%\TSJSO\66143.VUY
%HOMEPATH%\TSJSO\O21480.WKB
%HOMEPATH%\TSJSO\E89190.QQN
%HOMEPATH%\TSJSO\O64994.OJB
%HOMEPATH%\TSJSO\92370.OZS
%HOMEPATH%\TSJSO\54741.SQS
%HOMEPATH%\TSJSO\G75165.WUS
%HOMEPATH%\TSJSO\K94004.JEL
%HOMEPATH%\TSJSO\62594.KSD
%HOMEPATH%\TSJSO\I10475.HWN
%HOMEPATH%\TSJSO\88690.OXI
%HOMEPATH%\TSJSO\U66799.ZKB
%HOMEPATH%\TSJSO\55939.VDR
%HOMEPATH%\TSJSO\85425.ZIL
%HOMEPATH%\TSJSO\F44445.JAX
%HOMEPATH%\TSJSO\98860.GGD
%HOMEPATH%\TSJSO\A74797.OPG
%HOMEPATH%\TSJSO\M27723.QQM
%HOMEPATH%\TSJSO\P61067.CCA
%HOMEPATH%\TSJSO\44608.FYU
%HOMEPATH%\TSJSO\Z7017.JJT
%HOMEPATH%\TSJSO\71082.OGQ
%HOMEPATH%\TSJSO\75498.OEL
%HOMEPATH%\TSJSO\90361.VNA
%HOMEPATH%\TSJSO\5530.VUP
%HOMEPATH%\TSJSO\4987.UJB
%HOMEPATH%\TSJSO\L88714.KBH
%HOMEPATH%\TSJSO\2331.BKD
%HOMEPATH%\TSJSO\24644.EDB
%HOMEPATH%\TSJSO\94481.YIZ
%HOMEPATH%\TSJSO\E85641.XQH
%HOMEPATH%\TSJSO\32804.YNI
%HOMEPATH%\TSJSO\S61901.DNT
%HOMEPATH%\TSJSO\K4084.LNJ
%HOMEPATH%\TSJSO\B37161.GBU
%HOMEPATH%\TSJSO\88271.OAH
%HOMEPATH%\TSJSO\2608.XAE
%HOMEPATH%\TSJSO\X92589.BDT
%HOMEPATH%\TSJSO\57034.JTY
%HOMEPATH%\TSJSO\72231.SRU
%HOMEPATH%\TSJSO\Z95876.FLA
%HOMEPATH%\TSJSO\A45378.TKR
%HOMEPATH%\TSJSO\45773.YMF
%HOMEPATH%\TSJSO\51357.TVI
%HOMEPATH%\TSJSO\X55945.MCB
%HOMEPATH%\TSJSO\93221.TKD
%HOMEPATH%\TSJSO\D71086.YMT
%HOMEPATH%\TSJSO\24080.MDJ
%HOMEPATH%\TSJSO\X6110.HET
%HOMEPATH%\TSJSO\F65070.NEV
%HOMEPATH%\TSJSO\O90072.NGM
%HOMEPATH%\TSJSO\79020.LVL
%HOMEPATH%\TSJSO\U50479.LDV
%HOMEPATH%\TSJSO\E72255.WCU
%HOMEPATH%\TSJSO\Z40212.TYL
%HOMEPATH%\TSJSO\E17063.IIW
%HOMEPATH%\TSJSO\43701.OLW
%HOMEPATH%\TSJSO\M79031.UBU
%HOMEPATH%\TSJSO\39444.JZV
%HOMEPATH%\TSJSO\59469.RVO
%HOMEPATH%\TSJSO\51244.ENK
%HOMEPATH%\TSJSO\94092.HSB
%HOMEPATH%\TSJSO\86035.WGU
%HOMEPATH%\TSJSO\25810.QYW
%HOMEPATH%\TSJSO\61880.PKJ
%HOMEPATH%\TSJSO\53051.ICY
%HOMEPATH%\TSJSO\28391.JDZ
%HOMEPATH%\TSJSO\96386.DUH
%HOMEPATH%\TSJSO\76774.FRH
%HOMEPATH%\TSJSO\40104.YTN
%HOMEPATH%\TSJSO\T53111.FBH
%HOMEPATH%\TSJSO\38542.CJN
%HOMEPATH%\TSJSO\N95420.KWB
%HOMEPATH%\TSJSO\98675.KDI
%HOMEPATH%\TSJSO\D61880.SAL
%HOMEPATH%\TSJSO\S67189.WRG
%HOMEPATH%\TSJSO\E63097.KBQ
%HOMEPATH%\TSJSO\U61218.GMP
%HOMEPATH%\TSJSO\73592.YYI
%HOMEPATH%\TSJSO\H40485.RQH
%HOMEPATH%\TSJSO\W8434.OFH
%HOMEPATH%\TSJSO\Z3370.TNT
%HOMEPATH%\TSJSO\I84717.TTH
%HOMEPATH%\TSJSO\W47438.GDG
%HOMEPATH%\TSJSO\62969.JAY
%HOMEPATH%\TSJSO\34717.VKL
%HOMEPATH%\TSJSO\A32950.WSL
%HOMEPATH%\TSJSO\C80688.RFY
%HOMEPATH%\TSJSO\Q27102.JCP
%HOMEPATH%\TSJSO\64685.NSA
%HOMEPATH%\TSJSO\37252.YIW
%HOMEPATH%\TSJSO\64023.XYF
%HOMEPATH%\TSJSO\E93516.IND
%HOMEPATH%\TSJSO\23360.RXA
%HOMEPATH%\TSJSO\94166.MNF
%HOMEPATH%\TSJSO\C18842.VRR
%HOMEPATH%\TSJSO\S58224.WUL
%HOMEPATH%\TSJSO\52046.TSU
%HOMEPATH%\TSJSO\Z29352.IFX
%HOMEPATH%\TSJSO\N42079.LFS
%HOMEPATH%\TSJSO\83209.LZE
%HOMEPATH%\TSJSO\71978.ALF
%HOMEPATH%\TSJSO\Y48904.CHE
%HOMEPATH%\TSJSO\19162.LWY
%HOMEPATH%\TSJSO\G55492.EBK
%HOMEPATH%\TSJSO\Q48915.XPH
%HOMEPATH%\TSJSO\90897.NBG
%HOMEPATH%\TSJSO\82239.JHH
%HOMEPATH%\TSJSO\91267.QKU
%HOMEPATH%\TSJSO\E50107.HVB
%HOMEPATH%\TSJSO\65955.PHX
%HOMEPATH%\TSJSO\V35901.SEO
%HOMEPATH%\TSJSO\93532.YUU
%HOMEPATH%\TSJSO\9731.YZV
%HOMEPATH%\TSJSO\25628.CDI
%HOMEPATH%\TSJSO\P49369.JMK
%HOMEPATH%\TSJSO\P71761.ZYI
%HOMEPATH%\TSJSO\96591.LXC
%HOMEPATH%\TSJSO\F62077.USA
%HOMEPATH%\TSJSO\D80391.DBC
%HOMEPATH%\TSJSO\P79375.CXX
%HOMEPATH%\TSJSO\16519.UHM
%HOMEPATH%\TSJSO\49444.PRX
%HOMEPATH%\TSJSO\M93573.XAV
%HOMEPATH%\TSJSO\78015.ODE
%HOMEPATH%\TSJSO\90636.LSP
%HOMEPATH%\TSJSO\H49897.OYW
%HOMEPATH%\TSJSO\X88116.UTO
%HOMEPATH%\TSJSO\G1033.IQM
%HOMEPATH%\TSJSO\V90673.INB
%HOMEPATH%\TSJSO\S36149.HIQ
%HOMEPATH%\TSJSO\I12948.XRJ
%HOMEPATH%\TSJSO\5454.GKL
%HOMEPATH%\TSJSO\Z17691.TGC
%HOMEPATH%\TSJSO\41471.OLR
%HOMEPATH%\TSJSO\H6496.UEQ
%HOMEPATH%\TSJSO\47269.KUG
%HOMEPATH%\TSJSO\O98894.DEM
%HOMEPATH%\TSJSO\83391.YCA
%HOMEPATH%\TSJSO\9499.GQE
%HOMEPATH%\TSJSO\W99271.PSO
%HOMEPATH%\TSJSO\I17120.SET
%HOMEPATH%\TSJSO\J42991.EII
%HOMEPATH%\TSJSO\H35668.VDD
%HOMEPATH%\TSJSO\L57987.VGY
%HOMEPATH%\TSJSO\R3480.LVT
%HOMEPATH%\TSJSO\21380.MEY
%HOMEPATH%\TSJSO\48404.WKQ
%HOMEPATH%\TSJSO\I30886.SUO
%HOMEPATH%\TSJSO\22347.KCR
%HOMEPATH%\TSJSO\81073.ESG
%HOMEPATH%\TSJSO\E14595.HKO
%HOMEPATH%\TSJSO\N60366.ZOZ
%HOMEPATH%\TSJSO\51659.AIO
%HOMEPATH%\TSJSO\O5618.NZT
%HOMEPATH%\TSJSO\F49193.GBJ
%HOMEPATH%\TSJSO\B67744.DXN
%HOMEPATH%\TSJSO\75968.TIH
%HOMEPATH%\TSJSO\W28911.VKU
%HOMEPATH%\TSJSO\N7145.HZQ
%HOMEPATH%\TSJSO\D83708.UBE
%HOMEPATH%\TSJSO\24165.BWN
%HOMEPATH%\TSJSO\89946.PHW
%HOMEPATH%\TSJSO\15948.BJT
%HOMEPATH%\TSJSO\9305.FRF
%HOMEPATH%\TSJSO\T15129.ABZ
%HOMEPATH%\TSJSO\V86204.SPE
%HOMEPATH%\TSJSO\77713.KVV
%HOMEPATH%\TSJSO\U32039.VWR
%HOMEPATH%\TSJSO\F1186.YPO
%HOMEPATH%\TSJSO\50925.SBC
%HOMEPATH%\TSJSO\G85919.JAE
%HOMEPATH%\TSJSO\I78555.KEX
%HOMEPATH%\TSJSO\51271.MTC
%HOMEPATH%\TSJSO\M79193.ABP
%HOMEPATH%\TSJSO\94951.LQZ
%HOMEPATH%\TSJSO\Y3363.HNI
%HOMEPATH%\TSJSO\Q93351.DTY
%HOMEPATH%\TSJSO\X35322.IZI
%HOMEPATH%\TSJSO\24266.GPT
%HOMEPATH%\TSJSO\89841.UFZ
%HOMEPATH%\TSJSO\O69672.AND
%HOMEPATH%\TSJSO\Q86417.FQS
%HOMEPATH%\TSJSO\50575.LGX
%HOMEPATH%\TSJSO\F64902.CUJ
%HOMEPATH%\TSJSO\I68160.MLA
%HOMEPATH%\TSJSO\93252.MZQ
%HOMEPATH%\TSJSO\A3194.PEG
%HOMEPATH%\TSJSO\8444.PLA
%HOMEPATH%\TSJSO\58712.JQW
%HOMEPATH%\TSJSO\F13176.ALI
%HOMEPATH%\TSJSO\58154.XNW
%HOMEPATH%\TSJSO\V86679.MDP
%HOMEPATH%\TSJSO\34159.YQQ
%HOMEPATH%\TSJSO\K40862.EPY
%HOMEPATH%\TSJSO\T87601.PKB
%HOMEPATH%\TSJSO\89211.TXW
%HOMEPATH%\TSJSO\36005.GLM
%HOMEPATH%\TSJSO\43746.SED
%HOMEPATH%\TSJSO\13280.QAJ
%HOMEPATH%\TSJSO\55739.SXA
%HOMEPATH%\TSJSO\H17363.AXY
%HOMEPATH%\TSJSO\69564.GQP
%HOMEPATH%\TSJSO\64151.RNX
%HOMEPATH%\TSJSO\I15753.QGM
%HOMEPATH%\TSJSO\L72415.IJQ
%HOMEPATH%\TSJSO\K34475.QID
%HOMEPATH%\TSJSO\H83871.VTL
%HOMEPATH%\TSJSO\88983.IUC
%HOMEPATH%\TSJSO\U96176.PUS
%HOMEPATH%\TSJSO\H89096.MCS
%HOMEPATH%\TSJSO\C20290.HXH
%HOMEPATH%\TSJSO\3390.QKO
%HOMEPATH%\TSJSO\W80582.CFN
%HOMEPATH%\TSJSO\A80603.XQH
%HOMEPATH%\TSJSO\P61429.UFG
%HOMEPATH%\TSJSO\C62458.DRF
%HOMEPATH%\TSJSO\79550.WVL
%HOMEPATH%\TSJSO\O96523.ACZ
%HOMEPATH%\TSJSO\O84220.PEH
%HOMEPATH%\TSJSO\U24015.LES
%HOMEPATH%\TSJSO\C68174.WWM
%HOMEPATH%\TSJSO\V22597.XUX
%HOMEPATH%\TSJSO\P95836.XEL
%HOMEPATH%\TSJSO\17113.ZHV
%HOMEPATH%\TSJSO\Y85569.XKU
%HOMEPATH%\TSJSO\23367.FGQ
%HOMEPATH%\TSJSO\T31170.KIX
%HOMEPATH%\TSJSO\W34118.QNH
%HOMEPATH%\TSJSO\42144.BAG
%HOMEPATH%\TSJSO\32348.ODZ
%HOMEPATH%\TSJSO\13372.QLU
%HOMEPATH%\TSJSO\Z16922.GZE
%HOMEPATH%\TSJSO\Z7178.QMZ
%HOMEPATH%\TSJSO\64358.ZEN
%HOMEPATH%\TSJSO\G57987.FTN
%HOMEPATH%\TSJSO\62063.GHF
%HOMEPATH%\TSJSO\M1970.BIJ
%HOMEPATH%\TSJSO\39122.QYR
%HOMEPATH%\TSJSO\60169.DKX
%HOMEPATH%\TSJSO\V56675.IFO
%HOMEPATH%\TSJSO\8895.RXZ
%HOMEPATH%\TSJSO\59707.NJR
%HOMEPATH%\TSJSO\34295.MKR
%HOMEPATH%\TSJSO\C71790.ISY
%HOMEPATH%\TSJSO\I32357.PVL
%HOMEPATH%\TSJSO\73758.NOH
%HOMEPATH%\TSJSO\74915.LCT
%HOMEPATH%\TSJSO\26795.FHB
%HOMEPATH%\TSJSO\K67390.UCA
%HOMEPATH%\TSJSO\X26147.GTC
%HOMEPATH%\TSJSO\Y94179.SNG
%HOMEPATH%\TSJSO\3467.TLK
%HOMEPATH%\TSJSO\B85260.WVI
%HOMEPATH%\TSJSO\32983.ABZ
%HOMEPATH%\TSJSO\H11099.FEZ
%HOMEPATH%\TSJSO\88055.QAA
%HOMEPATH%\TSJSO\O23556.NYC
%HOMEPATH%\TSJSO\S1526.WQN
%HOMEPATH%\TSJSO\99436.MZU
%HOMEPATH%\TSJSO\66496.QTJ
%HOMEPATH%\TSJSO\H66089.GGY
%HOMEPATH%\TSJSO\39262.WHK
%HOMEPATH%\TSJSO\H92527.OCP
%HOMEPATH%\TSJSO\E2341.GHE
%HOMEPATH%\TSJSO\A4668.IAV
%HOMEPATH%\TSJSO\P9990.GMI
%HOMEPATH%\TSJSO\95308.GNE
%HOMEPATH%\TSJSO\V52971.MCA
%HOMEPATH%\TSJSO\T76474.BRK
%HOMEPATH%\TSJSO\Z5380.ZJW
%HOMEPATH%\TSJSO\Q95706.JIT
%HOMEPATH%\TSJSO\Z85217.AQF
%HOMEPATH%\TSJSO\97922.VYN
%HOMEPATH%\TSJSO\Z89788.OUI
%HOMEPATH%\TSJSO\46077.WWW
%HOMEPATH%\TSJSO\93137.ZTN
%HOMEPATH%\TSJSO\78239.ZQK
%HOMEPATH%\TSJSO\T38211.GKN
%HOMEPATH%\TSJSO\D69106.OUT
%HOMEPATH%\TSJSO\40723.PET
%HOMEPATH%\TSJSO\F83048.VGQ
%HOMEPATH%\TSJSO\72261.UNM
%HOMEPATH%\TSJSO\70814.JXP
%HOMEPATH%\TSJSO\45617.PQG
%HOMEPATH%\TSJSO\96952.SJX
%HOMEPATH%\TSJSO\10249.DHB
%HOMEPATH%\TSJSO\D1806.XMG
%HOMEPATH%\TSJSO\V51101.KFA
%HOMEPATH%\TSJSO\V26856.JCN
%HOMEPATH%\TSJSO\B66078.BNP
%HOMEPATH%\TSJSO\W82580.BHR
%HOMEPATH%\TSJSO\T1762.MTU
%HOMEPATH%\TSJSO\Z89346.GPR
%HOMEPATH%\TSJSO\J89294.JYS
%HOMEPATH%\TSJSO\35744.ZXJ
%HOMEPATH%\TSJSO\Q17019.YAI
%HOMEPATH%\TSJSO\L17194.HOM
%HOMEPATH%\TSJSO\45987.FLY
%HOMEPATH%\TSJSO\Y77577.ZRQ
%HOMEPATH%\TSJSO\W94384.CIN
%HOMEPATH%\TSJSO\94014.MKJ
%HOMEPATH%\TSJSO\D80357.TCQ
%HOMEPATH%\TSJSO\B92674.OKJ
%HOMEPATH%\TSJSO\63818.ITL
%HOMEPATH%\TSJSO\79314.JMQ
%HOMEPATH%\TSJSO\M1457.HGY
%HOMEPATH%\TSJSO\R93188.YDK
%HOMEPATH%\TSJSO\16434.RUM
%HOMEPATH%\TSJSO\Y40016.KMY
%HOMEPATH%\TSJSO\R98086.QKT
%HOMEPATH%\TSJSO\3562.vbs
%HOMEPATH%\TSJSO\18740.OVJ
%HOMEPATH%\TSJSO\37783.STE
%HOMEPATH%\TSJSO\settings.ini
%HOMEPATH%\TSJSO\722439.dat
%HOMEPATH%\TSJSO\273434.LTG
%HOMEPATH%\TSJSO\EMNHO.exe
%HOMEPATH%\TSJSO\159719.dat
%HOMEPATH%\TSJSO\E92329.FBY
%HOMEPATH%\TSJSO\V30328.PIM
%HOMEPATH%\TSJSO\P98551.RMF
%HOMEPATH%\TSJSO\67632.KMP
%HOMEPATH%\TSJSO\46315.GNT
%HOMEPATH%\TSJSO\26021.LWV
%HOMEPATH%\TSJSO\H39532.LLB
%HOMEPATH%\TSJSO\N48084.PMV
%HOMEPATH%\TSJSO\C50996.SBA
%HOMEPATH%\TSJSO\L8968.JQE
%HOMEPATH%\TSJSO\71047.XQF
%HOMEPATH%\TSJSO\17575.UFW
%HOMEPATH%\TSJSO\79573.ZFL
%HOMEPATH%\TSJSO\96589.IMZ
%HOMEPATH%\TSJSO\X31325.EDX
%HOMEPATH%\TSJSO\L7240.FJY
%HOMEPATH%\TSJSO\90789.PHA
%HOMEPATH%\TSJSO\P70948.HFC
%HOMEPATH%\TSJSO\56704.TWR
%HOMEPATH%\TSJSO\81522.ZBM
%HOMEPATH%\TSJSO\Q33001.FES
%HOMEPATH%\TSJSO\17226.EPL
%HOMEPATH%\TSJSO\33694.DYE
%HOMEPATH%\TSJSO\56728.IJX
%HOMEPATH%\TSJSO\K82224.MUA
%HOMEPATH%\TSJSO\I55575.NME
%HOMEPATH%\TSJSO\M73239.CJN
%HOMEPATH%\TSJSO\W61682.WOL
%HOMEPATH%\TSJSO\22764.JTI
%HOMEPATH%\TSJSO\25657.VTD
%HOMEPATH%\TSJSO\53415.AGF
%HOMEPATH%\TSJSO\16089.DVQ
%HOMEPATH%\TSJSO\87886.XLT
%HOMEPATH%\TSJSO\15534.PZT
%HOMEPATH%\TSJSO\77023.FOT
%HOMEPATH%\TSJSO\91050.ONF
%HOMEPATH%\TSJSO\Z55669.GOP
%HOMEPATH%\TSJSO\58998.MUX
%HOMEPATH%\TSJSO\45336.NPU
%HOMEPATH%\TSJSO\98696.MGU
%HOMEPATH%\TSJSO\23472.WTN
%HOMEPATH%\TSJSO\V35077.BVA
%HOMEPATH%\TSJSO\Q89330.BSQ
%HOMEPATH%\TSJSO\23887.FWP
%HOMEPATH%\TSJSO\S55778.KOO
%HOMEPATH%\TSJSO\A82167.VIU
%HOMEPATH%\TSJSO\X75108.QLX
%HOMEPATH%\TSJSO\Y20802.JAY
%HOMEPATH%\TSJSO\83312.QPQ
%HOMEPATH%\TSJSO\32113.KLU
%HOMEPATH%\TSJSO\K44064.BEW
%HOMEPATH%\TSJSO\7467.FPJ
%HOMEPATH%\TSJSO\R21466.GXG
%HOMEPATH%\TSJSO\X99624.XMR
%HOMEPATH%\TSJSO\94772.BDS
%HOMEPATH%\TSJSO\D26175.SMM
%HOMEPATH%\TSJSO\42592.OHM
%HOMEPATH%\TSJSO\59845.AZP
%HOMEPATH%\TSJSO\26572.WLH
%HOMEPATH%\TSJSO\49013.WNN
%HOMEPATH%\TSJSO\88458.UOX
%HOMEPATH%\TSJSO\14822.ZNK
%HOMEPATH%\TSJSO\B54214.XLO
%HOMEPATH%\TSJSO\95013.ZKA
%HOMEPATH%\TSJSO\K15597.GPD
%HOMEPATH%\TSJSO\31909.TGZ
%HOMEPATH%\TSJSO\O74740.DZU
%HOMEPATH%\TSJSO\46504.OOW
%HOMEPATH%\TSJSO\68723.URA
%HOMEPATH%\TSJSO\22667.CCQ
%HOMEPATH%\TSJSO\O56932.UQS
%HOMEPATH%\TSJSO\80899.NMI
%HOMEPATH%\TSJSO\V34205.JMY
%HOMEPATH%\TSJSO\9667.FZJ
%HOMEPATH%\TSJSO\56379.CKR
%HOMEPATH%\TSJSO\I62340.RNV
%HOMEPATH%\TSJSO\X99528.KCE
%HOMEPATH%\TSJSO\L12021.WWW
%HOMEPATH%\TSJSO\B69284.JCN
%HOMEPATH%\TSJSO\79736.JEP
%HOMEPATH%\TSJSO\12053.DNF
%HOMEPATH%\TSJSO\45286.QAY
%HOMEPATH%\TSJSO\37459.RGG
%HOMEPATH%\TSJSO\38263.RHI
%HOMEPATH%\TSJSO\N87382.LNF
%HOMEPATH%\TSJSO\N86163.CCV
%HOMEPATH%\TSJSO\18402.WHK
%HOMEPATH%\TSJSO\X38364.XPW
%HOMEPATH%\TSJSO\A62090.PIR
%HOMEPATH%\TSJSO\14215.ARX
%HOMEPATH%\TSJSO\N54395.FYE
%HOMEPATH%\TSJSO\W71517.TXS
%HOMEPATH%\TSJSO\45846.NSY
%HOMEPATH%\TSJSO\X10879.HMX
%HOMEPATH%\TSJSO\I44039.YGT
%HOMEPATH%\TSJSO\94601.PZV
%HOMEPATH%\TSJSO\C44672.YSN
%HOMEPATH%\TSJSO\S98100.AXM
%HOMEPATH%\TSJSO\54539.DUK
%HOMEPATH%\TSJSO\G78115.LTX
%HOMEPATH%\TSJSO\G40490.AUR
%HOMEPATH%\TSJSO\P13968.MUN
%HOMEPATH%\TSJSO\Z60128.ULZ
%HOMEPATH%\TSJSO\95510.TDC
%HOMEPATH%\TSJSO\11910.IPA
%HOMEPATH%\TSJSO\99537.UWB
%HOMEPATH%\TSJSO\29048.ZVE
%HOMEPATH%\TSJSO\76324.XME
%HOMEPATH%\TSJSO\G70451.QSH
%HOMEPATH%\TSJSO\1229.XIA
%HOMEPATH%\TSJSO\K86335.XLO
%HOMEPATH%\TSJSO\C28620.KKE
%HOMEPATH%\TSJSO\R89682.SKH
%HOMEPATH%\TSJSO\20589.JGK
%HOMEPATH%\TSJSO\Q50874.UYJ
%HOMEPATH%\TSJSO\49637.YHV
%HOMEPATH%\TSJSO\15556.TET
%HOMEPATH%\TSJSO\A20854.HKQ
%HOMEPATH%\TSJSO\E71793.DJJ
%HOMEPATH%\TSJSO\18526.ZXK
%HOMEPATH%\TSJSO\66744.THK
%HOMEPATH%\TSJSO\33361.DYA
%HOMEPATH%\TSJSO\97206.ANS
%HOMEPATH%\TSJSO\W7209.RRO
%HOMEPATH%\TSJSO\80996.ACB
%HOMEPATH%\TSJSO\D44956.XPV
%HOMEPATH%\TSJSO\Q72669.UZQ
%HOMEPATH%\TSJSO\L53352.LTQ
%HOMEPATH%\TSJSO\G60137.CEA
%HOMEPATH%\TSJSO\99884.SFI
%HOMEPATH%\TSJSO\17006.PZW
%HOMEPATH%\TSJSO\80912.FUD
%HOMEPATH%\TSJSO\34958.ORB
%HOMEPATH%\TSJSO\17696.TGT
%HOMEPATH%\TSJSO\H65244.NEZ
%HOMEPATH%\TSJSO\45155.BTW
%HOMEPATH%\TSJSO\Q45170.NTY
%HOMEPATH%\TSJSO\58404.VKQ
%HOMEPATH%\TSJSO\58558.FIQ
%HOMEPATH%\TSJSO\6170.IKV
%HOMEPATH%\TSJSO\V71552.IQZ
%HOMEPATH%\TSJSO\9480.FUU
%HOMEPATH%\TSJSO\D29495.TNA
%HOMEPATH%\TSJSO\X34580.UXN
%HOMEPATH%\TSJSO\O62764.EME
%HOMEPATH%\TSJSO\I39152.ZMT
%HOMEPATH%\TSJSO\Z79951.YJP
%HOMEPATH%\TSJSO\Q22044.UIS
%HOMEPATH%\TSJSO\Z68506.FGO
%HOMEPATH%\TSJSO\O82076.TIS
%HOMEPATH%\TSJSO\H88928.UED
%HOMEPATH%\TSJSO\91900.PUZ
%HOMEPATH%\TSJSO\46820.WCE
%HOMEPATH%\TSJSO\90016.KMD
%HOMEPATH%\TSJSO\75921.XSU
%HOMEPATH%\TSJSO\X62517.DFP
%HOMEPATH%\TSJSO\83295.DED
%HOMEPATH%\TSJSO\M94597.HCG
%HOMEPATH%\TSJSO\O72271.OPZ
%HOMEPATH%\TSJSO\75595.SHK
%HOMEPATH%\TSJSO\32898.VKI
%HOMEPATH%\TSJSO\F10390.SBY
%HOMEPATH%\TSJSO\2518.RZN
%HOMEPATH%\TSJSO\V21650.SGZ
%HOMEPATH%\TSJSO\A56880.XRH
%HOMEPATH%\TSJSO\65448.JXR
%HOMEPATH%\TSJSO\31189.QHE
%HOMEPATH%\TSJSO\K88486.PUN
%HOMEPATH%\TSJSO\70533.NFY
%HOMEPATH%\TSJSO\U39085.TLA
%HOMEPATH%\TSJSO\6767.COZ
%HOMEPATH%\TSJSO\10541.YAJ
%HOMEPATH%\TSJSO\S34052.NCG
%HOMEPATH%\TSJSO\N57254.LFZ
%HOMEPATH%\TSJSO\B98708.PXK
%HOMEPATH%\TSJSO\3183.EPD
%HOMEPATH%\TSJSO\39291.PMP
%HOMEPATH%\TSJSO\87618.OEG
%HOMEPATH%\TSJSO\G68193.PQN
%HOMEPATH%\TSJSO\P3821.PXA
%HOMEPATH%\TSJSO\97114.FUQ
%HOMEPATH%\TSJSO\K83366.XRB
%HOMEPATH%\TSJSO\Z23889.CLN
%HOMEPATH%\TSJSO\R16314.ZRN
%HOMEPATH%\TSJSO\56133.RBP
%HOMEPATH%\TSJSO\G35130.GAM
%HOMEPATH%\TSJSO\X65095.ZWU
%HOMEPATH%\TSJSO\B57495.UUJ
%HOMEPATH%\TSJSO\55575.FDZ
%HOMEPATH%\TSJSO\C3411.FKH
%HOMEPATH%\TSJSO\58387.ZTS
%HOMEPATH%\TSJSO\65809.PUU
%HOMEPATH%\TSJSO\39667.SAO

Deletes the following files:

%HOMEPATH%\TSJSO\REONZANI.dat

Network activity:

Connects to:

'6k####775.no-ip.biz':4443
'5k####775.no-ip.biz':4443
'7k####775.no-ip.biz':4443
'9k####775.no-ip.biz':4443
'8k####775.no-ip.biz':4443
'1k####775.no-ip.biz':4443
'ke####75.no-ip.biz':4443
'2k####775.no-ip.biz':4443
'4k####775.no-ip.biz':4443
'3k####775.no-ip.biz':4443

UDP:

DNS ASK 6k####775.no-ip.biz
DNS ASK 5k####775.no-ip.biz
DNS ASK 7k####775.no-ip.biz
DNS ASK 9k####775.no-ip.biz
DNS ASK 8k####775.no-ip.biz
DNS ASK 1k####775.no-ip.biz
DNS ASK ke####75.no-ip.biz
DNS ASK 2k####775.no-ip.biz
DNS ASK 4k####775.no-ip.biz
DNS ASK 3k####775.no-ip.biz

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial