Technical Information
Modifies file system
Creates the following files
- %WINDIR%\×ô¶¯µçâ¼.ini
Substitutes the following executable files
- <Full path to file>
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c DEL /F /A /Q <Full path to file>
- '%WINDIR%\syswow64\cmd.exe' /c RD /S /Q <Full path to file>
- '%WINDIR%\syswow64\cmd.exe' /c DEL /F /A /Q <Current directory>\cfe99.tmp
- '%WINDIR%\syswow64\cmd.exe' /c RD /S /Q <Current directory>\cfe99.tmp
- '%WINDIR%\syswow64\cmd.exe' /c DEL /F /A /Q <Full path to file>' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c RD /S /Q <Full path to file>' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c DEL /F /A /Q <Current directory>\cfe99.tmp' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c RD /S /Q <Current directory>\cfe99.tmp' (with hidden window)
