Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\tmp.exe
- %APPDATA%\microsoftedge.dll
- %TEMP%\svchost_1764.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoftedge.dll
- %TEMP%\svchost_1764.tmp
Deletes following files that it created itself
- %TEMP%\svchost_1764.tmp
- %TEMP%\tmp.exe
Network activity
Connects to
- 'google.com':80
UDP
- DNS ASK google.com
Miscellaneous
Creates and executes the following
- '%TEMP%\tmp.exe'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\explorer.exe"
