Trojan.Hosts.15141

Technical Information

Modifies file system :

Creates the following files:

%TEMP%\dw.log

Deletes the following files:

<SYSTEM32>\dllcache\catsrvut.dll
<SYSTEM32>\dllcache\catsrvps.dll
<SYSTEM32>\dllcache\catsrv.dll
<SYSTEM32>\dllcache\cb32.exe
<SYSTEM32>\dllcache\cdfview.dll
<SYSTEM32>\dllcache\cdfs.sys
<SYSTEM32>\dllcache\ccfgnt.dll
<SYSTEM32>\dllcache\cards.dll
<SYSTEM32>\dllcache\calc.exe
<SYSTEM32>\dllcache\cacls.exe
<SYSTEM32>\dllcache\cabview.dll
<SYSTEM32>\dllcache\callcont.dll
<SYSTEM32>\dllcache\capesnpn.dll
<SYSTEM32>\dllcache\cap7146.sys
<SYSTEM32>\dllcache\camocx.dll
<SYSTEM32>\dllcache\cdm.dll
<SYSTEM32>\dllcache\chajei.ime
<SYSTEM32>\dllcache\cfgwiz.exe
<SYSTEM32>\dllcache\cfgmgr32.dll
<SYSTEM32>\dllcache\change.exe
<SYSTEM32>\dllcache\chgport.exe
<SYSTEM32>\dllcache\chglogon.exe
<SYSTEM32>\dllcache\charmap.exe
<SYSTEM32>\dllcache\cfgbkend.dll
<SYSTEM32>\dllcache\certcli.dll
<SYSTEM32>\dllcache\cdosys.dll
<SYSTEM32>\dllcache\cdmodem.dll
<SYSTEM32>\dllcache\certmap.ocx
<SYSTEM32>\dllcache\cewmdm.dll
<SYSTEM32>\dllcache\certwiz.ocx
<SYSTEM32>\dllcache\certmgr.dll
<SYSTEM32>\dllcache\big5.nls
<SYSTEM32>\dllcache\bidispl.dll
<SYSTEM32>\dllcache\beep.sys
<SYSTEM32>\dllcache\bitsprx2.dll
<SYSTEM32>\dllcache\blastcln.exe
<SYSTEM32>\dllcache\blackbox.dll
<SYSTEM32>\dllcache\bitsprx3.dll
<SYSTEM32>\dllcache\bckgzm.exe
<SYSTEM32>\dllcache\basesrv.dll
<SYSTEM32>\dllcache\avwav.dll
<SYSTEM32>\dllcache\avtapi.dll
<SYSTEM32>\dllcache\batmeter.dll
<SYSTEM32>\dllcache\bckgres.dll
<SYSTEM32>\dllcache\bckg.dll
<SYSTEM32>\dllcache\batt.dll
<SYSTEM32>\dllcache\blue_ss.dll
<SYSTEM32>\dllcache\browseui.dll
<SYSTEM32>\dllcache\browser.dll
<SYSTEM32>\dllcache\browselc.dll
<SYSTEM32>\dllcache\browsewm.dll
<SYSTEM32>\dllcache\cabinet.dll
<SYSTEM32>\dllcache\btpanui.dll
<SYSTEM32>\dllcache\brpinfo.dll
<SYSTEM32>\dllcache\browscap.dll
<SYSTEM32>\dllcache\bootok.exe
<SYSTEM32>\dllcache\bootcfg.exe
<SYSTEM32>\dllcache\bnts.dll
<SYSTEM32>\dllcache\bootvid.dll
<SYSTEM32>\dllcache\bridge.sys
<SYSTEM32>\dllcache\bopomofo.nls
<SYSTEM32>\dllcache\bootvrfy.exe
<SYSTEM32>\dllcache\chgusr.exe
<SYSTEM32>\dllcache\cmutil.dll
<SYSTEM32>\dllcache\cmstp.exe
<SYSTEM32>\dllcache\cmsetacl.dll
<SYSTEM32>\dllcache\cnetcfg.dll
<SYSTEM32>\dllcache\coadmin.dll
<SYSTEM32>\dllcache\cnvfat.dll
<SYSTEM32>\dllcache\cnfgprts.ocx
<SYSTEM32>\dllcache\cmprops.dll
<SYSTEM32>\dllcache\cmdl32.exe
<SYSTEM32>\dllcache\cmdial32.dll
<SYSTEM32>\dllcache\cmd.exe
<SYSTEM32>\dllcache\cmmon32.exe
<SYSTEM32>\dllcache\cmpbk32.dll
<SYSTEM32>\dllcache\cmnresm.dll
<SYSTEM32>\dllcache\cmnclim.dll
<SYSTEM32>\dllcache\colbact.dll
<SYSTEM32>\dllcache\compobj.dll
<SYSTEM32>\dllcache\compfilt.dll
<SYSTEM32>\dllcache\compatui.dll
<SYSTEM32>\dllcache\compstui.dll
<SYSTEM32>\dllcache\comrereg.exe
<SYSTEM32>\dllcache\comrepl.exe
<SYSTEM32>\dllcache\comrepl.dll
<SYSTEM32>\dllcache\compact.exe
<SYSTEM32>\dllcache\comcat.dll
<SYSTEM32>\dllcache\comadmin.dll
<SYSTEM32>\dllcache\comaddin.dll
<SYSTEM32>\dllcache\comctl32.dll
<SYSTEM32>\dllcache\comp.exe
<SYSTEM32>\dllcache\commdlg.dll
<SYSTEM32>\dllcache\comdlg32.dll
<SYSTEM32>\dllcache\ciadmin.dll
<SYSTEM32>\dllcache\chtskf.dll
<SYSTEM32>\dllcache\chtskdic.dll
<SYSTEM32>\dllcache\cic.dll
<SYSTEM32>\dllcache\cintime.dll
<SYSTEM32>\dllcache\cimwin32.dll
<SYSTEM32>\dllcache\cidaemon.exe
<SYSTEM32>\dllcache\chtmbx.dll
<SYSTEM32>\dllcache\chkr.dll
<SYSTEM32>\dllcache\chkntfs.exe
<SYSTEM32>\dllcache\chkdsk.exe
<SYSTEM32>\dllcache\chkrres.dll
<SYSTEM32>\dllcache\chtbrkr.dll
<SYSTEM32>\dllcache\chsbrkr.dll
<SYSTEM32>\dllcache\chkrzm.exe
<SYSTEM32>\dllcache\cintlgnt.ime
<SYSTEM32>\dllcache\cleanmgr.exe
<SYSTEM32>\dllcache\clbcatq.dll
<SYSTEM32>\dllcache\clbcatex.dll
<SYSTEM32>\dllcache\clipbrd.exe
<SYSTEM32>\dllcache\cmcfg32.dll
<SYSTEM32>\dllcache\clusapi.dll
<SYSTEM32>\dllcache\clipsrv.exe
<SYSTEM32>\dllcache\clb.dll
<SYSTEM32>\dllcache\cipher.exe
<SYSTEM32>\dllcache\ciodm.dll
<SYSTEM32>\dllcache\cintsetp.exe
<SYSTEM32>\dllcache\cisvc.exe
<SYSTEM32>\dllcache\class_ss.dll
<SYSTEM32>\dllcache\classpnp.sys
<SYSTEM32>\dllcache\ckcnv.exe
<SYSTEM32>\dllcache\avmeter.dll
<SYSTEM32>\dllcache\agentpsh.dll
<SYSTEM32>\dllcache\agentmpx.dll
<SYSTEM32>\dllcache\agentdpv.dll
<SYSTEM32>\dllcache\agentsr.dll
<SYSTEM32>\dllcache\agt0404.dll
<SYSTEM32>\dllcache\agt0401.dll
<SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\dllcache\agentdp2.dll
<SYSTEM32>\dllcache\advapi32.dll
<SYSTEM32>\dllcache\adsnw.dll
<SYSTEM32>\dllcache\adsnt.dll
<SYSTEM32>\dllcache\advpack.dll
<SYSTEM32>\dllcache\agentctl.dll
<SYSTEM32>\dllcache\agentanm.dll
<SYSTEM32>\dllcache\afd.sys
<SYSTEM32>\dllcache\agt0405.dll
<SYSTEM32>\dllcache\agt0412.dll
<SYSTEM32>\dllcache\agt0411.dll
<SYSTEM32>\dllcache\agt0410.dll
<SYSTEM32>\dllcache\agt0413.dll
<SYSTEM32>\dllcache\agt0416.dll
<SYSTEM32>\dllcache\agt0415.dll
<SYSTEM32>\dllcache\agt0414.dll
<SYSTEM32>\dllcache\agt040e.dll
<SYSTEM32>\dllcache\agt0408.dll
<SYSTEM32>\dllcache\agt0407.dll
<SYSTEM32>\dllcache\agt0406.dll
<SYSTEM32>\dllcache\agt0409.dll
<SYSTEM32>\dllcache\agt040d.dll
<SYSTEM32>\dllcache\agt040c.dll
<SYSTEM32>\dllcache\agt040b.dll
<SYSTEM32>\dllcache\aclua.dll
<SYSTEM32>\dllcache\acledit.dll
<SYSTEM32>\dllcache\aclayers.dll
<SYSTEM32>\dllcache\aclui.dll
<SYSTEM32>\dllcache\activeds.tlb
<SYSTEM32>\dllcache\activeds.dll
<SYSTEM32>\dllcache\acspecfc.dll
<SYSTEM32>\dllcache\acgenral.dll
<SYSTEM32>\dllcache\6to4svc.dll
<SYSTEM32>\dllcache\12520850.cpx
<SYSTEM32>\dllcache\12520437.cpx
<SYSTEM32>\dllcache\aaaamon.dll
<SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\dllcache\acctres.dll
<SYSTEM32>\dllcache\access.cpl
<SYSTEM32>\dllcache\actmovie.exe
<SYSTEM32>\dllcache\adsiis51.dll
<SYSTEM32>\dllcache\adrot.dll
<SYSTEM32>\dllcache\adptif.dll
<SYSTEM32>\dllcache\adsldp.dll
<SYSTEM32>\dllcache\adsnds.dll
<SYSTEM32>\dllcache\adsmsext.dll
<SYSTEM32>\dllcache\adsldpc.dll
<SYSTEM32>\dllcache\admxprox.dll
<SYSTEM32>\dllcache\admexs.dll
<SYSTEM32>\dllcache\acxtrnal.dll
<SYSTEM32>\dllcache\actxprxy.dll
<SYSTEM32>\dllcache\admin.dll
<SYSTEM32>\dllcache\admwprox.dll
<SYSTEM32>\dllcache\admparse.dll
<SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\dllcache\agt0419.dll
<SYSTEM32>\dllcache\atmlane.sys
<SYSTEM32>\dllcache\atmfd.dll
<SYSTEM32>\dllcache\atmepvc.sys
<SYSTEM32>\dllcache\atmlib.dll
<SYSTEM32>\dllcache\atrace.dll
<SYSTEM32>\dllcache\atmuni.sys
<SYSTEM32>\dllcache\atmpvcno.dll
<SYSTEM32>\dllcache\atmarpc.sys
<SYSTEM32>\dllcache\asyncmac.sys
<SYSTEM32>\dllcache\asycfilt.dll
<SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\atmadm.exe
<SYSTEM32>\dllcache\atl.dll
<SYSTEM32>\dllcache\atkctrs.dll
<SYSTEM32>\dllcache\attrib.exe
<SYSTEM32>\dllcache\autolfn.exe
<SYSTEM32>\dllcache\autofmt.exe
<SYSTEM32>\dllcache\autodisc.dll
<SYSTEM32>\dllcache\avicap.dll
<SYSTEM32>\dllcache\avifile.dll
<SYSTEM32>\dllcache\avifil32.dll
<SYSTEM32>\dllcache\avicap32.dll
<SYSTEM32>\dllcache\autoconv.exe
<SYSTEM32>\dllcache\authfilt.dll
<SYSTEM32>\dllcache\auditusr.exe
<SYSTEM32>\dllcache\audiosrv.dll
<SYSTEM32>\dllcache\author.dll
<SYSTEM32>\dllcache\autochk.exe
<SYSTEM32>\dllcache\authz.dll
<SYSTEM32>\dllcache\author.exe
<SYSTEM32>\dllcache\amstream.dll
<SYSTEM32>\dllcache\alrsvc.dll
<SYSTEM32>\dllcache\alg.exe
<SYSTEM32>\dllcache\ansi.sys
<SYSTEM32>\dllcache\append.exe
<SYSTEM32>\dllcache\appconf.dll
<SYSTEM32>\dllcache\apcups.dll
<SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\dllcache\agt0804.dll
<SYSTEM32>\dllcache\agt041f.dll
<SYSTEM32>\dllcache\agt041d.dll
<SYSTEM32>\dllcache\agt0816.dll
<SYSTEM32>\dllcache\agtintl.dll
<SYSTEM32>\dllcache\agtctl15.tlb
<SYSTEM32>\dllcache\agt0c0a.dll
<SYSTEM32>\dllcache\apphelp.dll
<SYSTEM32>\dllcache\asp51.dll
<SYSTEM32>\dllcache\asferror.dll
<SYSTEM32>\dllcache\asctrls.ocx
<SYSTEM32>\dllcache\aspperf.dll
<SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\asptxn.dll
<SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\appmgmts.dll
<SYSTEM32>\dllcache\apph_sp.sdb
<SYSTEM32>\dllcache\apphelp.sdb
<SYSTEM32>\dllcache\appmgr.dll
<SYSTEM32>\dllcache\aqueue.dll
<SYSTEM32>\dllcache\appwiz.cpl
<SYSTEM32>\dllcache\apps.chm

Modifies the HOSTS file.

Network activity:

Connects to:

'localhost':10
'ft#.##ocity.aiq.ru':21
'sm##.gmail.com':587

UDP:

DNS ASK ft#.##ocity.aiq.ru
DNS ASK sm##.gmail.com

Miscellaneous:

Searches for the following windows:

ClassName: '(null)' WindowName: 'Hello'

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial