Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\3448557064
Modifies file system
Creates the following files
- %TEMP%\autf823.tmp
- %TEMP%\kquurgw
- %CommonProgramFiles%\<File name>.exe
Deletes the following files
- %TEMP%\autf823.tmp
- %TEMP%\kquurgw
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' \c schtasks \create \sc onlogon \tn 3448557064 \rl highest \tr C:\PROGRA~2\COMMON~1\<File name>.exe
- '%WINDIR%\syswow64\schtasks.exe' /create /sc onlogon /tn 3448557064 /rl highest /tr C:\PROGRA~2\COMMON~1\<File name>.exe
- '%WINDIR%\syswow64\cmd.exe' \c schtasks \create \sc onlogon \tn 3448557064 \rl highest \tr C:\PROGRA~2\COMMON~1\<File name>.exe' (with hidden window)
