Substitutes the following executable system files:
<SYSTEM32>\dllcache\services.exe with <SYSTEM32>\dllcache\services.exe.new
<SYSTEM32>\dllcache\lsass.exe with <SYSTEM32>\dllcache\lsass.exe.new
<SYSTEM32>\dllcache\smss.exe with <SYSTEM32>\dllcache\smss.exe.new
<SYSTEM32>\dllcache\winlogon.exe with <SYSTEM32>\dllcache\winlogon.exe.new
<SYSTEM32>\dllcache\spoolsv.exe with <SYSTEM32>\dllcache\spoolsv.exe.new
<SYSTEM32>\dllcache\ctfmon.exe with <SYSTEM32>\dllcache\ctfmon.exe.new
<SYSTEM32>\dllcache\svchost.exe with <SYSTEM32>\dllcache\svchost.exe.new
<SYSTEM32>\dllcache\explorer.exe with <SYSTEM32>\dllcache\explorer.exe.new
<Auxiliary element> with <Auxiliary element>
<SYSTEM32>\services.exe with <SYSTEM32>\services.exe.1
<SYSTEM32>\lsass.exe with <SYSTEM32>\lsass.exe.1
<SYSTEM32>\smss.exe with <SYSTEM32>\smss.exe.1
<SYSTEM32>\winlogon.exe with <SYSTEM32>\winlogon.exe.1
<SYSTEM32>\spoolsv.exe with <SYSTEM32>\spoolsv.exe.1
<SYSTEM32>\ctfmon.exe with <SYSTEM32>\ctfmon.exe.1
<SYSTEM32>\svchost.exe with <SYSTEM32>\svchost.exe.1
%WINDIR%\explorer.exe with %WINDIR%\explorer.exe.1
Modifies file system :
Creates the following files:
<Current directory>\0225A8B8.dll
Deletes the following files:
<SYSTEM32>\cscript.exe.1
Moves the following system files:
from <SYSTEM32>\spoolsv.exe to <SYSTEM32>\spoolsv.exe.0
from %WINDIR%\explorer.exe to %WINDIR%\explorer.exe.0
from <Auxiliary element> to <Auxiliary element>
from <SYSTEM32>\ctfmon.exe to <SYSTEM32>\ctfmon.exe.0
from <SYSTEM32>\svchost.exe to <SYSTEM32>\svchost.exe.0
from <SYSTEM32>\winlogon.exe to <SYSTEM32>\winlogon.exe.0
from <SYSTEM32>\smss.exe to <SYSTEM32>\smss.exe.0
from <SYSTEM32>\lsass.exe to <SYSTEM32>\lsass.exe.0
from <SYSTEM32>\services.exe to <SYSTEM32>\services.exe.0
Moves the following files:
from <SYSTEM32>\dllcache\winlogon.exe.new to <SYSTEM32>\dllcache\winlogon.exe
from <SYSTEM32>\dllcache\services.exe.new to <SYSTEM32>\dllcache\services.exe
from <SYSTEM32>\ctfmon.exe.new to <SYSTEM32>\ctfmon.exe
from <SYSTEM32>\dllcache\smss.exe.new to <SYSTEM32>\dllcache\smss.exe
from <SYSTEM32>\dllcache\lsass.exe.new to <SYSTEM32>\dllcache\lsass.exe
from <SYSTEM32>\dllcache\spoolsv.exe.new to <SYSTEM32>\dllcache\spoolsv.exe
from <SYSTEM32>\dllcache\ctfmon.exe.new to <SYSTEM32>\dllcache\ctfmon.exe
from <SYSTEM32>\dllcache\svchost.exe.new to <SYSTEM32>\dllcache\svchost.exe
from <SYSTEM32>\dllcache\explorer.exe.new to <SYSTEM32>\dllcache\explorer.exe
from <SYSTEM32>\smss.exe.new to <SYSTEM32>\smss.exe
from <SYSTEM32>\winlogon.exe.new to <SYSTEM32>\winlogon.exe
from <Auxiliary element> to <Auxiliary element>
from <Auxiliary name>.1 to <Auxiliary name>
from <SYSTEM32>\services.exe.new to <SYSTEM32>\services.exe
from %WINDIR%\explorer.exe.new to %WINDIR%\explorer.exe
from <SYSTEM32>\spoolsv.exe.new to <SYSTEM32>\spoolsv.exe
from <SYSTEM32>\lsass.exe.new to <SYSTEM32>\lsass.exe
from <SYSTEM32>\svchost.exe.new to <SYSTEM32>\svchost.exe
Network activity:
Connects to:
'ir#.##linkcorp.net':6667
'ir#.##laxynet.org':6667
'ir#.##serv.us.to':6667
'ir#.#izon.net':6667
'ef###.port80.se':6667
'ir#.#nynet.org':6667
'ir#.##iverse.com':6667
'ir#.#reeirc.de':6667
'dr####.flexnet.pro':6667
UDP:
DNS ASK ir#.##linkcorp.net
DNS ASK ir#.##laxynet.org
DNS ASK ir#.##serv.us.to
DNS ASK ir#.#izon.net
DNS ASK ef###.port80.se
DNS ASK ir#.#nynet.org
DNS ASK ir#.##iverse.com
DNS ASK ir#.#reeirc.de
DNS ASK dr####.flexnet.pro
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: ''
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni