Technical Information
Modifies file system
Deletes the following files
- %WINDIR%\prefetch\1.exe-bf9d2cef.pf
- %WINDIR%\prefetch\msohtmed.exe-68e5ab1e.pf
- %WINDIR%\prefetch\msohtmed.exe-35a8ca79.pf
- %WINDIR%\prefetch\msif1a9.tmp-fa1ca0e9.pf
- %WINDIR%\prefetch\msiexec.exe-e09a077a.pf
- %WINDIR%\prefetch\msiexec.exe-a2d55cb6.pf
- %WINDIR%\prefetch\msieb32.tmp-a0d60608.pf
- %WINDIR%\prefetch\msidf38.tmp-4231cf8d.pf
- %WINDIR%\prefetch\msi6837.tmp-63debe2c.pf
- %WINDIR%\prefetch\microsoft toolkit.exe-9dae6a40.pf
- %WINDIR%\prefetch\msi419f.tmp-b24cc418.pf
- %WINDIR%\prefetch\mscorsvw.exe-c3c515bd.pf
- %WINDIR%\prefetch\mscorsvw.exe-57d17daf.pf
- %WINDIR%\prefetch\msconfig.exe-3a52734e.pf
- %WINDIR%\prefetch\mofcomp.exe-fde76efc.pf
- %WINDIR%\prefetch\mofcomp.exe-8fe3d558.pf
- %WINDIR%\prefetch\mmc.exe-f5dc4f82.pf
- %WINDIR%\prefetch\mmc.exe-f39cded6.pf
- %WINDIR%\prefetch\mmc.exe-53159585.pf
- %WINDIR%\prefetch\msdtc.exe-cc1dec77.pf
- %WINDIR%\prefetch\migpolwin.exe-79e606fc.pf
- %WINDIR%\prefetch\msoxmled.exe-e473a01d.pf
- %WINDIR%\prefetch\ose.exe-533d8ac9.pf
- %WINDIR%\prefetch\readyboot\trace7.fx
- %WINDIR%\prefetch\readyboot\trace6.fx
- %WINDIR%\prefetch\readyboot\trace10.fx
- %WINDIR%\prefetch\rdrcef.exe-5852a8de.pf
- %WINDIR%\prefetch\powerpnt.exe-158b76a4.pf
- %WINDIR%\prefetch\pfsvperfstats.bin
- %WINDIR%\prefetch\pcaui.exe-3e82c312.pf
- %WINDIR%\prefetch\osppsvc.exe-e53d3cc0.pf
- %WINDIR%\prefetch\mstsc.exe-76a46e8a.pf
- %WINDIR%\prefetch\mstsc.exe-5283258e.pf
- %WINDIR%\prefetch\ose.exe-51c16f0e.pf
- %WINDIR%\prefetch\opera_crashreporter.exe-e30ebed0.pf
- %WINDIR%\prefetch\opera.exe-9dd4e019.pf
- %WINDIR%\prefetch\ntosboot-b00dfaad.pf
- %WINDIR%\prefetch\ngen.exe-ec3f9239.pf
- %WINDIR%\prefetch\ngen.exe-ae594a6b.pf
- %WINDIR%\prefetch\ngen.exe-7900743e.pf
- %WINDIR%\prefetch\netsh.exe-f1b6da12.pf
- %WINDIR%\prefetch\ose00001.exe-3da4b844.pf
- %WINDIR%\prefetch\mdm.exe-ea9906df.pf
- %WINDIR%\prefetch\manageddbgca.exe-6ea1439b.pf
- %WINDIR%\prefetch\logonui.exe-09140401.pf
- %WINDIR%\prefetch\control.exe-817f8f1d.pf
- %WINDIR%\prefetch\conhost.exe-1f3e9d7e.pf
- %WINDIR%\prefetch\cmd.exe-4a81b364.pf
- %WINDIR%\prefetch\bcssync.exe-3f6c64a2.pf
- %WINDIR%\prefetch\audiodg.exe-bdfd3029.pf
- %WINDIR%\prefetch\aspnet_regiis.exe-b76f1ad7.pf
- %WINDIR%\prefetch\arh.exe-f07e6c2c.pf
- %WINDIR%\prefetch\defrag.exe-588f90ad.pf
- %WINDIR%\prefetch\agrobust.db
- %WINDIR%\prefetch\aggluad_p_s-1-5-21-1960123792-2022915161-3775307078-1001.db
- %WINDIR%\prefetch\agglglobalhistory.db
- %WINDIR%\prefetch\agglfgapphistory.db
- %WINDIR%\prefetch\agglfaulthistory.db
- %WINDIR%\prefetch\agcx_sc4.db
- %WINDIR%\prefetch\agapplaunch.db
- %WINDIR%\prefetch\addinutil.exe-fef23417.pf
- %WINDIR%\prefetch\acrord32.exe-acf2947d.pf
- %WINDIR%\prefetch\aggluad_s-1-5-21-1960123792-2022915161-3775307078-1001.db
- %WINDIR%\prefetch\dexplore.exe-1749d792.pf
- %WINDIR%\prefetch\dbgclr.exe-ad18e06e.pf
- %WINDIR%\prefetch\dllhost.exe-5e46fa0d.pf
- %WINDIR%\prefetch\layout.ini
- %WINDIR%\prefetch\firefox.exe-18acfcff.pf
- %WINDIR%\prefetch\launcher.exe-e41e51ee.pf
- %WINDIR%\prefetch\kmsnano_setup.tmp-11a1562c.pf
- %WINDIR%\prefetch\kmsnano_setup.exe-631a87c6.pf
- %WINDIR%\prefetch\javaw.exe-dccf0ab8.pf
- %WINDIR%\prefetch\ipconfig.exe-912f3d5b.pf
- %WINDIR%\prefetch\install.exe-455f2d9b.pf
- %WINDIR%\prefetch\iexplore.exe-4b6c9213.pf
- %WINDIR%\prefetch\flashplayerupdateservice.exe-216d9c35.pf
- %WINDIR%\prefetch\explorer.exe-a80e4f97.pf
- %WINDIR%\prefetch\dllhost.exe-766398d2.pf
- %WINDIR%\prefetch\excel.exe-53a22446.pf
- %WINDIR%\prefetch\drvinst.exe-4cb4314a.pf
- %WINDIR%\prefetch\dotnetfx.exe-fe16be11.pf
- %WINDIR%\prefetch\dllhost.exe-ecb71776.pf
- %WINDIR%\prefetch\dllhost.exe-d58da3a6.pf
- %WINDIR%\prefetch\dllhost.exe-b2eb1806.pf
- %WINDIR%\prefetch\dllhost.exe-861f96f8.pf
- %WINDIR%\prefetch\dllhost.exe-7faa2e4c.pf
- %WINDIR%\prefetch\readyboot\trace8.fx
- %WINDIR%\prefetch\readyboot\trace9.fx
Moves itself
- from <Full path to file> to <Current directory>\5oksuu8j.exe
Network activity
Connects to
- 'public-trust.com':80
TCP
- 'as###coderz.com':443
- 'ma####.bootstrapcdn.com':443
- 'fo###.#oogleapis.com':443
- 'aj##.#oogleapis.com':443
- 'fo###.gstatic.com':443
- 'google.com':443
- 'gs##tic.com':443
UDP
- DNS ASK as###coderz.com
- DNS ASK microsoft.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK ma####.bootstrapcdn.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK fo###.gstatic.com
- DNS ASK google.com
- DNS ASK gs##tic.com
- DNS ASK st####.rapidssl.com
- DNS ASK public-trust.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
