Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\mmc.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\autofmt.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\ВІ+hsГЎl‘ГўšГґ.txt
- %HOMEPATH%\desktop\Г¦5”€
- %HOMEPATH%\desktop\w.ВЅœГџ@В¦yi‹.txt
- %HOMEPATH%\desktop\oВІ‰]^ö×[ž.txt
- %HOMEPATH%\desktop\aœВЌГѕeГЅ—Г©:w.txt
- %HOMEPATH%\desktop\tf‡•Г§В°Г¶Г¬4ГЎ.txt
- %HOMEPATH%\desktop\ВЅ˜Вѕ`jВі$ГёВі5.txt
- %HOMEPATH%\desktop\ВєВї6€u¾ÿ秜.txt
- %HOMEPATH%\desktop\ГіГіВЇz_wГ¦‹Вј.txt
- %HOMEPATH%\desktop\ВўГІh!ВЎГџvj4s.txt
- %HOMEPATH%\desktop\Вѕ6ГґГ7[¶òá£.txt
- %HOMEPATH%\desktop\ГЈГЎГёi’Вјi${ВЃ.txt
- %HOMEPATH%\desktop\êáhý¸çûú(t.txt
- %HOMEPATH%\desktop\ƒ:ВЏВҐГјГѕ †".txt
- %HOMEPATH%\desktop\}ВЅ^î»q`[В®œ.txt
- %HOMEPATH%\desktop\ВЅim-ГµksГhr.txt
- %HOMEPATH%\desktop\aaГЎœ]bГ ‚=ГҐ.txt
- %WINDIR%\panther\unattendgc\setuperr.log
- %HOMEPATH%\desktop\‚§¾ÿéyf„ГїВ©.txt
- %HOMEPATH%\desktop\å¶ù0ВЃГ¶šГ
- %HOMEPATH%\desktop\7¶e:fdç' .txt
- %HOMEPATH%\desktop\žГ¤'qxГЅГ«žВќ.txt
- %HOMEPATH%\desktop\1-ГЄ(ВўВЇhj7r.txt
- %HOMEPATH%\desktop\z_ГІkxo4В№ov.txt
- %HOMEPATH%\desktop\rs…ГҐžВ©Г±um–.txt
- %HOMEPATH%\desktop\%ètäd£({w.txt
- %HOMEPATH%\desktop\Г§wГЎГґbВЄГі1Г Гµ.txt
- %HOMEPATH%\desktop\2ВєГіГ¬‡dnГ¦5ƒ.txt
- %HOMEPATH%\desktop\Г¶7gГІ˜ВІ;6;Г°.txt
- %HOMEPATH%\desktop\sæål;äªn`ß.txt
- %HOMEPATH%\desktop\[.´põi+°çb.txt
- %HOMEPATH%\desktop\¦ò¶šВµГ¬vВ¦$Гґ.txt
- %HOMEPATH%\desktop\ВґžГ—ГЅВЃzyГёГ§j.txt
- %HOMEPATH%\desktop\В [ùìú›Вў4ВќВѕ.txt
- %HOMEPATH%\desktop\ž
- %HOMEPATH%\desktop\nВё0t‹Г»m .ГЇ.txt
- %HOMEPATH%\desktop\m;[Вѕ5ВЈГЄ“Г№Гј.txt
- %HOMEPATH%\desktop\1•Гєi9`òùæô.txt
- %HOMEPATH%\desktop\«à £wiâ]ª1ð.txt
- %HOMEPATH%\desktop\fõêö¥ùjГѕГў†.txt
- %HOMEPATH%\desktop\ВЇГҐ^Вґ]Г Г®‡В§;.txt
- %HOMEPATH%\desktop\ГЇ!Г¬
- %HOMEPATH%\desktop\v[ bõþú¯ð².txt
- %HOMEPATH%\desktop\uВ®aflГј`
- %HOMEPATH%\desktop\x¸ãî¨óz®äô.txt
- %HOMEPATH%\desktop\i8ВєГ°qdГЅВ©zГЈ.txt
- %HOMEPATH%\desktop\–_ВЇВІœВЎv†q™.txt
- %HOMEPATH%\desktop\o®•mГёГё…Г±Вў.txt
- %HOMEPATH%\desktop\ГўГЇ„=Гѕ9€%s.txt
- %HOMEPATH%\desktop\.ilГҐkc‰0™g.txt
- %HOMEPATH%\desktop\ГЎГ¤+9ГЎ•'èð¦.txt
- %HOMEPATH%\desktop\Г»4Г®ВВѕ)ВҐeˆВі.txt
- %HOMEPATH%\desktop\6ГЅГџ'ВµffdВЇВІ.txt
- %HOMEPATH%\desktop\®å:ù+µ¿5w.txt
- %HOMEPATH%\desktop\ép¾éá
- %HOMEPATH%\desktop\jo›0Г«`Г«†7.txt
- %HOMEPATH%\desktop\ГґВЈВўžГєВѕГЅВ¦2€.txt
- %HOMEPATH%\desktop\î×@vö¡wu@{.txt
- %HOMEPATH%\desktop\i‡Г№uВ«mp&`‰.txt
- %HOMEPATH%\desktop\£÷dðôx¥×¼°.txt
- %HOMEPATH%\desktop\gВїœГ§Г©‘m—°ð.txt
- %HOMEPATH%\desktop\öõ·ñæå@jr2.txt
- %HOMEPATH%\desktop\0ВЄtГєwžpçà è.txt
- %HOMEPATH%\desktop\Ⱦh›В»läñye.txt
- %HOMEPATH%\desktop\rВ°((ðû0ГґГ№•.txt
- %HOMEPATH%\desktop\c¢ßæñˆГЅГ¦nГЈ.txt
- %HOMEPATH%\desktop\Г¤d
- %HOMEPATH%\desktop\В©1²æãœ†В«ГЎ^.txt
- %HOMEPATH%\desktop\”梢vВѕГ®pîö.txt
- %HOMEPATH%\desktop\lùëqîì;k¯à .txt
- %TEMP%\ddodiag.xml
Deletes the following files
- <SYSTEM32>\logfiles\sqm\sqmlogger.etl.010
- <SYSTEM32>\logfiles\sqm\sqmlogger.etl.009
- <SYSTEM32>\logfiles\sqm\sqmlogger.etl.004
- <SYSTEM32>\logfiles\sqm\sqmlogger.etl.003
- <SYSTEM32>\logfiles\sqm\sqmlogger.etl.002
- <SYSTEM32>\logfiles\sqm\sqmlogger.etl.001
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
Miscellaneous
Searches for the following windows
- ClassName: 'progman' WindowName: ''
- ClassName: 'shelldll_defview' WindowName: ''
- ClassName: 'syslistview32' WindowName: ''
- ClassName: '' WindowName: 'Private Character Editor '
- ClassName: 'EhStorAuthnClass' WindowName: ''
- ClassName: '' WindowName: 'Presentation Settings'
Creates and executes the following
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\eventvwr.msc"' (with hidden window)
Executes the following
- '<SYSTEM32>\muiunattend.exe'
- '<SYSTEM32>\services.exe'
- '<SYSTEM32>\netcfg.exe'
- '<SYSTEM32>\cttune.exe'
- '<SYSTEM32>\cscript.exe'
- '<SYSTEM32>\mcbuilder.exe'
- '<SYSTEM32>\synchost.exe'
- '<SYSTEM32>\rpcping.exe'
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\eventvwr.msc"
- '<SYSTEM32>\wextract.exe'
- '<SYSTEM32>\lsass.exe'
- '<SYSTEM32>\nltest.exe'
- '<SYSTEM32>\pcawrk.exe'
- '<SYSTEM32>\mdsched.exe'
- '<SYSTEM32>\bdehdcfg.exe'
- '<SYSTEM32>\tapiunattend.exe'
- '<SYSTEM32>\timeout.exe'
- '<SYSTEM32>\control.exe' /name Microsoft.GettingStarted
- '<SYSTEM32>\mshta.exe'
- '<SYSTEM32>\fsutil.exe'
- '<SYSTEM32>\dism.exe'
- '<SYSTEM32>\auditpol.exe'
- '<SYSTEM32>\rmactivate_isv.exe'
- '<SYSTEM32>\wksprt.exe'
- '<SYSTEM32>\eventvwr.exe'
- '<SYSTEM32>\p2phost.exe'
- '<SYSTEM32>\xcopy.exe'
- '<SYSTEM32>\wininit.exe'
- '<SYSTEM32>\dxpserver.exe'
- '<SYSTEM32>\rwinsta.exe'
- '<SYSTEM32>\spoolsv.exe'
- '<SYSTEM32>\presentationsettings.exe'
- '<SYSTEM32>\netplwiz.exe'
- '<SYSTEM32>\prevhost.exe'
- '<SYSTEM32>\esentutl.exe'
- '<SYSTEM32>\lpremove.exe'
- '<SYSTEM32>\write.exe'
- '<SYSTEM32>\dpnsvr.exe'
- '<SYSTEM32>\w32tm.exe'
- '<SYSTEM32>\wfs.exe'
- '<SYSTEM32>\chgport.exe'
- '<SYSTEM32>\fxsunatd.exe'
- '<SYSTEM32>\pushprinterconnections.exe'
- '<SYSTEM32>\query.exe'
- '<SYSTEM32>\systempropertiesremote.exe'
- '<SYSTEM32>\syskey.exe'
- '<SYSTEM32>\typeperf.exe'
- '<SYSTEM32>\runlegacycplelevated.exe'
- '<SYSTEM32>\pkgmgr.exe'
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\gpscript.exe'
- '<SYSTEM32>\chgusr.exe'
- '%ProgramFiles%\windows nt\accessories\wordpad.exe'
- '<SYSTEM32>\schtasks.exe'
- '<SYSTEM32>\chkntfs.exe'
- '<SYSTEM32>\displayswitch.exe'
- '<SYSTEM32>\bthudtask.exe'
- '<SYSTEM32>\quser.exe'
- '<SYSTEM32>\finger.exe'
- '<SYSTEM32>\deviceeject.exe'
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\compmgmt.msc" /s
- '<SYSTEM32>\bridgeunattend.exe'
- '<SYSTEM32>\winlogon.exe'
- '<SYSTEM32>\upnpcont.exe'
- '<SYSTEM32>\odbcconf.exe'
- '<SYSTEM32>\ucsvc.exe'
- '<SYSTEM32>\setieinstalleddate.exe'
- '<SYSTEM32>\rdpinit.exe'
- '<SYSTEM32>\adaptertroubleshooter.exe'
- '<SYSTEM32>\systempropertiescomputername.exe'
- '<SYSTEM32>\gettingstarted.exe'
- '<SYSTEM32>\mstsc.exe'
- '<SYSTEM32>\infdefaultinstall.exe'
- '<SYSTEM32>\utilman.exe'
- '<SYSTEM32>\reset.exe'
- '<SYSTEM32>\vaultsysui.exe'
- '<SYSTEM32>\dcomcnfg.exe'
- '<SYSTEM32>\mmc.exe' <SYSTEM32>\comexp.msc
- '<SYSTEM32>\hdwwiz.exe'
- '<SYSTEM32>\replace.exe'
- '<SYSTEM32>\diantz.exe'
- '<SYSTEM32>\taskmgr.exe'
- '<SYSTEM32>\robocopy.exe'
- '<SYSTEM32>\tswbprxy.exe'
- '<SYSTEM32>\subst.exe'
- '<SYSTEM32>\logman.exe'
- '<SYSTEM32>\eudcedit.exe'
- '<SYSTEM32>\taskhost.exe'
- '<SYSTEM32>\utilman.exe' /debug
- '<SYSTEM32>\mfpmp.exe'
- '<SYSTEM32>\searchindexer.exe'
- '<SYSTEM32>\netiougc.exe'
- '<SYSTEM32>\cofire.exe'
- '<SYSTEM32>\net1.exe'
- '<SYSTEM32>\atbroker.exe'
- '<SYSTEM32>\dinotify.exe'
- '<SYSTEM32>\qappsrv.exe'
- '<SYSTEM32>\fltmc.exe'
- '<SYSTEM32>\wsmanhttpconfig.exe'
- '<SYSTEM32>\proquota.exe'
- '<SYSTEM32>\chglogon.exe'
- '<SYSTEM32>\taskeng.exe'
- '<SYSTEM32>\ddodiag.exe'
- '<SYSTEM32>\drvinst.exe'
- '<SYSTEM32>\bcdedit.exe'
- '<SYSTEM32>\magnify.exe'
- '<SYSTEM32>\gpresult.exe'
- '<SYSTEM32>\presentationhost.exe'
- '<SYSTEM32>\ipconfig.exe'
- '<SYSTEM32>\eventcreate.exe'
- '<SYSTEM32>\relog.exe'
- '<SYSTEM32>\diskpart.exe'
- '<SYSTEM32>\regini.exe'
- '<SYSTEM32>\schtasks.exe' /delete /f /TN "Microsoft\Windows\Customer Experience Improvement Program\Uploader"
- '<SYSTEM32>\plasrv.exe'
- '<SYSTEM32>\wsqmcons.exe'
- '<SYSTEM32>\rdpsign.exe'
- '<SYSTEM32>\sppsvc.exe'
- '<SYSTEM32>\rekeywiz.exe'
- '<SYSTEM32>\compact.exe'
- '<SYSTEM32>\charmap.exe'
- '<SYSTEM32>\rdpclip.exe'
- '<SYSTEM32>\wiaacmgr.exe'
- '<SYSTEM32>\sndvol.exe'
- '<SYSTEM32>\bootcfg.exe'
- '<SYSTEM32>\msinfo32.exe'
- '<SYSTEM32>\ksetup.exe'
- '<SYSTEM32>\isoburn.exe'
- '<SYSTEM32>\dispdiag.exe'
- '<SYSTEM32>\efsui.exe'
- '<SYSTEM32>\msra.exe'
- '<SYSTEM32>\wusa.exe'
- '%WINDIR%\syswow64\dxdiag.exe'
- '<SYSTEM32>\dllhst3g.exe'
- '<SYSTEM32>\dxdiag.exe'
- '<SYSTEM32>\searchprotocolhost.exe'
- '<SYSTEM32>\compmgmtlauncher.exe'
- '<SYSTEM32>\vmicsvc.exe'
- '<SYSTEM32>\mountvol.exe'
- '<SYSTEM32>\certutil.exe'
- '<SYSTEM32>\pcalua.exe'
- '<SYSTEM32>\setspn.exe'
- '<SYSTEM32>\rasphone.exe'
- '<SYSTEM32>\ehstorauthn.exe'
- '<SYSTEM32>\tswpfwrp.exe'
