Technical Information
Malicious functions:
Creates and executes the following:
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\bomgar-scc.exe "-nctuf" "<Full path to virus>" "-install2" "<Full path to virus>" "%TEMP%\nss3.tmp\" "%ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\"
- %TEMP%\nss3.tmp\bomgar-scc.exe -nctuf <Full path to virus> -install1 "<Full path to virus>"
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_viewer_actual_size.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_viewer_fit.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_sidebar_collapsed.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_sidebar_expanded.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_viewer_quality16.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_ft_animation0.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_ft_animation1.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_viewer_quality32.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_viewer_quality8.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\bomgar-scc.exe
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_cb_access_key.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\app_icon_32.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\BF13227E-B446-4E12-913E-7E5FBBEE54F6
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_cb_private.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_panic.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_sidebar_alert.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_cb_survey.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\button_cb_team.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\remove.exe
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\server.lic
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\nstvhook.dll
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\preload-en-us.rdf
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\settings-init.ini
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\settings-cc.ini31724
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\settings.ini22156
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\uninstall.bat
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\settings.ini10040
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_ft_animation4.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_pinned_connected.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_ft_animation2.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_ft_animation3.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_pinned_disconnected.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_rep_viewing.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_ss_watermark.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_rep_not_present.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\indicator_rep_present.png
- %ALLUSERSPROFILE%\Application Data\bomgar-scc-4E857D38\app_icon_16.png
- %TEMP%\nss3.tmp\button_sidebar_alert.png
- %TEMP%\nss3.tmp\button_sidebar_collapsed.png
- %TEMP%\nss3.tmp\button_cb_team.png
- %TEMP%\nss3.tmp\button_panic.png
- %TEMP%\nss3.tmp\button_sidebar_expanded.png
- %TEMP%\nss3.tmp\button_viewer_quality16.png
- %TEMP%\nss3.tmp\button_viewer_quality32.png
- %TEMP%\nss3.tmp\button_viewer_actual_size.png
- %TEMP%\nss3.tmp\button_viewer_fit.png
- %TEMP%\nss3.tmp\server.lic
- %TEMP%\nss3.tmp\preload-en-us.rdf
- %TEMP%\nsx2.tmp
- %TEMP%\nss3.tmp\System.dll
- %TEMP%\nss3.tmp\app_icon_16.png
- %TEMP%\nss3.tmp\button_cb_private.png
- %TEMP%\nss3.tmp\button_cb_survey.png
- %TEMP%\nss3.tmp\app_icon_32.png
- %TEMP%\nss3.tmp\button_cb_access_key.png
- %TEMP%\nss3.tmp\indicator_ss_watermark.png
- %TEMP%\nss3.tmp\nstvhook.dll
- %TEMP%\nss3.tmp\indicator_rep_present.png
- %TEMP%\nss3.tmp\indicator_rep_viewing.png
- %TEMP%\nss3.tmp\uninstall.bat
- %TEMP%\nss3.tmp\settings-init.ini
- %TEMP%\nss3.tmp\remove.exe
- %TEMP%\nss3.tmp\bomgar-scc.exe
- %TEMP%\nss3.tmp\BF13227E-B446-4E12-913E-7E5FBBEE54F6
- %TEMP%\nss3.tmp\indicator_ft_animation1.png
- %TEMP%\nss3.tmp\indicator_ft_animation2.png
- %TEMP%\nss3.tmp\button_viewer_quality8.png
- %TEMP%\nss3.tmp\indicator_ft_animation0.png
- %TEMP%\nss3.tmp\indicator_ft_animation3.png
- %TEMP%\nss3.tmp\indicator_pinned_disconnected.png
- %TEMP%\nss3.tmp\indicator_rep_not_present.png
- %TEMP%\nss3.tmp\indicator_ft_animation4.png
- %TEMP%\nss3.tmp\indicator_pinned_connected.png
Deletes the following files:
- %TEMP%\nss3.tmp\indicator_pinned_disconnected.png
- %TEMP%\nss3.tmp\indicator_pinned_connected.png
- %TEMP%\nss3.tmp\indicator_rep_present.png
- %TEMP%\nss3.tmp\indicator_rep_not_present.png
- %TEMP%\nss3.tmp\indicator_ft_animation2.png
- %TEMP%\nss3.tmp\indicator_ft_animation1.png
- %TEMP%\nss3.tmp\indicator_ft_animation4.png
- %TEMP%\nss3.tmp\indicator_ft_animation3.png
- %TEMP%\nss3.tmp\indicator_rep_viewing.png
- %TEMP%\nss3.tmp\settings-init.ini
- %TEMP%\nss3.tmp\server.lic
- %TEMP%\nss3.tmp\uninstall.bat
- %TEMP%\nss3.tmp\System.dll
- %TEMP%\nss3.tmp\nstvhook.dll
- %TEMP%\nss3.tmp\indicator_ss_watermark.png
- %TEMP%\nss3.tmp\remove.exe
- %TEMP%\nss3.tmp\preload-en-us.rdf
- %TEMP%\nss3.tmp\indicator_ft_animation0.png
- %TEMP%\nss3.tmp\button_cb_private.png
- %TEMP%\nss3.tmp\button_cb_access_key.png
- %TEMP%\nss3.tmp\button_cb_team.png
- %TEMP%\nss3.tmp\button_cb_survey.png
- %TEMP%\nss3.tmp\app_icon_32.png
- %TEMP%\nss3.tmp\app_icon_16.png
- %TEMP%\nss3.tmp\bomgar-scc.exe
- %TEMP%\nss3.tmp\BF13227E-B446-4E12-913E-7E5FBBEE54F6
- %TEMP%\nss3.tmp\button_panic.png
- %TEMP%\nss3.tmp\button_viewer_quality16.png
- %TEMP%\nss3.tmp\button_viewer_fit.png
- %TEMP%\nss3.tmp\button_viewer_quality8.png
- %TEMP%\nss3.tmp\button_viewer_quality32.png
- %TEMP%\nss3.tmp\button_sidebar_collapsed.png
- %TEMP%\nss3.tmp\button_sidebar_alert.png
- %TEMP%\nss3.tmp\button_viewer_actual_size.png
- %TEMP%\nss3.tmp\button_sidebar_expanded.png
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
