Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Terminates or attempts to terminate
the following user processes:
- ecmd.exe
Modifies file system :
Creates the following files:
- <Auxiliary element>
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'JqtRnyNi'
- ClassName: '(null)' WindowName: 'hAerwMrGv '
- ClassName: '(null)' WindowName: ' LuB e '
- ClassName: '(null)' WindowName: ' fAok nqsM'
- ClassName: '(null)' WindowName: 'bYh ut wmqlxA '
- ClassName: '(null)' WindowName: 'racsWwIvomj'
- ClassName: '(null)' WindowName: 'bfywlp'
- ClassName: '(null)' WindowName: 'HKg Np'
- ClassName: '(null)' WindowName: 'dndRk'
- ClassName: '(null)' WindowName: 'hPZI'
- ClassName: '(null)' WindowName: ' KgeQCXpLzdt'
- ClassName: '(null)' WindowName: 'nD nwjrosFcIp'
- ClassName: '(null)' WindowName: 'vtdujyy'
- ClassName: '(null)' WindowName: 'blZYuemuoPrz'
- ClassName: '(null)' WindowName: 'FxOGv wT'
- ClassName: '(null)' WindowName: ' aQek nhzTlnbG'
- ClassName: '(null)' WindowName: 'PAGjvwU'
- ClassName: '(null)' WindowName: 'vSezXQbfZ'
- ClassName: '(null)' WindowName: 'p rtvnF dc'
- ClassName: '(null)' WindowName: 'nupytvZSoefSpe'
- ClassName: '(null)' WindowName: 'kiPx'
- ClassName: '(null)' WindowName: ' bC XTfJSq'
- ClassName: '(null)' WindowName: ' fu YD fEboc'
- ClassName: '(null)' WindowName: 'IiojswfceYU'
- ClassName: '(null)' WindowName: 'UEg'
- ClassName: '(null)' WindowName: 'hmafhVZZeXLK l'
- ClassName: '(null)' WindowName: 'lNDeu'
- ClassName: '(null)' WindowName: 'drbo Wc'
- ClassName: '(null)' WindowName: 'dNuif c '
- ClassName: '(null)' WindowName: ' KRGZopqALh pf'
- ClassName: '(null)' WindowName: 'rc ogk y'
- ClassName: '(null)' WindowName: 'jjbyDmreD uavs'
- ClassName: '(null)' WindowName: 'rabsgMvHwgoplr'
- ClassName: '(null)' WindowName: 'qpmlVkhbXP'
- ClassName: '(null)' WindowName: 'E kyh LPWg'
- ClassName: '(null)' WindowName: 'pqsmywRz '
- ClassName: '(null)' WindowName: 'stlxzaaayoln'
- ClassName: '(null)' WindowName: 'oS V'
- ClassName: '(null)' WindowName: 'fiWctfhmsM pQuB'
- ClassName: '(null)' WindowName: 'xAd GaRsu'
- ClassName: '(null)' WindowName: 'Ah joSkU'
- ClassName: '(null)' WindowName: 'dzo GhrGLH o W'
- ClassName: '(null)' WindowName: 'jdcegwtj '
- ClassName: '(null)' WindowName: 'cJH m dy '
- ClassName: '(null)' WindowName: 'qX vs'
- ClassName: '(null)' WindowName: 'pJydt iMjb'
- ClassName: '(null)' WindowName: 'ndfCa mzpbi'
- ClassName: '(null)' WindowName: 'yUb q'
- ClassName: '(null)' WindowName: 'wIhZb O wv'
- ClassName: '(null)' WindowName: 'i oudPY'
- ClassName: '(null)' WindowName: 'mSzjqi '
- ClassName: '(null)' WindowName: 'hTonok Qr'
- ClassName: '(null)' WindowName: 'hnjS'
- ClassName: '(null)' WindowName: 'hw Vw qfjdd'
- ClassName: '(null)' WindowName: 'gry ip pbp'
- ClassName: '(null)' WindowName: 'alqzshTqr tfr'
- ClassName: '(null)' WindowName: 'zdl '
- ClassName: '(null)' WindowName: 'xkbJp'
- ClassName: '(null)' WindowName: 'Y ma qjwTl'
- ClassName: '(null)' WindowName: 'kMyEWKl t'
- ClassName: '(null)' WindowName: 'CbxblMv'
- ClassName: '(null)' WindowName: 'pzLzb '
- ClassName: '(null)' WindowName: ' un'
- ClassName: '(null)' WindowName: 'R INtoLW kE'
- ClassName: '(null)' WindowName: 'iDx daJ'
- ClassName: '(null)' WindowName: ' RVhukf'
- ClassName: '(null)' WindowName: 'BaAehf fJjaX'
- ClassName: '(null)' WindowName: 'ugiA ku'
- ClassName: '(null)' WindowName: 'EwjoVsc'
- ClassName: '(null)' WindowName: 'lsdmdJQzkcFw'
- ClassName: '(null)' WindowName: 'c vafbEz'
- ClassName: '(null)' WindowName: ' Kq Mnd'
- ClassName: '(null)' WindowName: 'giqCHkxK f pe'
- ClassName: '(null)' WindowName: ' pD bhI Xg'
- ClassName: '(null)' WindowName: 'yK PqhCZx'
- ClassName: '(null)' WindowName: 'OplhnltcAe'
- ClassName: '(null)' WindowName: 'tjMisPkzIjDYYd '
- ClassName: '(null)' WindowName: ' y iwpng'
- ClassName: '(null)' WindowName: 'gQgc Bkyh'
- ClassName: '(null)' WindowName: ' sc IIv'
- ClassName: '(null)' WindowName: 'o lS '
- ClassName: '(null)' WindowName: 'pfyAukDd'
- ClassName: '(null)' WindowName: 'xgX g c wdwN lfk '
- ClassName: '(null)' WindowName: 'Icfpsr Mmcisyi'
- ClassName: '(null)' WindowName: 'haubFxxFf'
- ClassName: '(null)' WindowName: 'eeR zIWKnegD'
- ClassName: '(null)' WindowName: 'qdwI'
- ClassName: '(null)' WindowName: 'sampchYrmtwhi'
- ClassName: '(null)' WindowName: ' H qbzj '
- ClassName: '(null)' WindowName: 'fIsojXmXICT'
- ClassName: '(null)' WindowName: ' muAmfSeyHks'
- ClassName: '(null)' WindowName: 'mfT Kb'
- ClassName: '(null)' WindowName: ' js '
- ClassName: '(null)' WindowName: 'glntf Yba uqO'
- ClassName: '(null)' WindowName: ' CgnxkpjQxY'
- ClassName: '(null)' WindowName: 'ru A '
- ClassName: '(null)' WindowName: ' GxkpA WGgh'
- ClassName: '(null)' WindowName: ' y d '
- ClassName: '(null)' WindowName: 'z MbTjXqP rkh'
- ClassName: '(null)' WindowName: 'KYyue'
- ClassName: '(null)' WindowName: 'ejzrzoHpa'
- ClassName: '(null)' WindowName: ' uJQ Htm'
- ClassName: '(null)' WindowName: 'oSsxjDq'
- ClassName: '(null)' WindowName: 'Gp wwad'
- ClassName: '(null)' WindowName: 'SDiw qq w'
- ClassName: '(null)' WindowName: 'a dnhzkgRMZgM qG'
- ClassName: '(null)' WindowName: 'zOdSuDogGl v '
- ClassName: '(null)' WindowName: 'itUuke j'
- ClassName: '(null)' WindowName: 'v kbyeu'
- ClassName: '(null)' WindowName: 'afv QJZ'
- ClassName: '(null)' WindowName: 'qI Nmw'
- ClassName: '(null)' WindowName: ' l XKDo'
- ClassName: '(null)' WindowName: 'n PLNkl'
- ClassName: '(null)' WindowName: 'Suxz hBvjkIi'
- ClassName: '(null)' WindowName: 'lhWmTVPn OBZ'
- ClassName: '(null)' WindowName: 'njjgpZhb'
- ClassName: '(null)' WindowName: 'pWgr'
- ClassName: '(null)' WindowName: 'hb tuPg'
- ClassName: '(null)' WindowName: 'F k '
- ClassName: '(null)' WindowName: 'oEdnnK'
- ClassName: '(null)' WindowName: 'gnKfafT c'
- ClassName: '(null)' WindowName: 'X Af Ya AD'
- ClassName: '(null)' WindowName: ' HElyXwp HgoBw'
- ClassName: '(null)' WindowName: 'Osn r x'