Technical Information
Malicious functions:
Executes the following:
- '%WINDIR%\alg.exe'
- '<SYSTEM32>\cmd.exe'
- '%TEMP%\20f09\20f092.exe'
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- <SYSTEM32>\set.ini
- %WINDIR%\alg.exe
- %TEMP%\20eea\20efa1.S. Emerg
- %TEMP%\20f09\20f092.exe
Moves the following files:
- from %TEMP%\20f09\20f092.exe to %WINDIR%\Help\sdel.exe
