Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\cleanmgr.exe'
Modifies file system
Creates the following files
- C:\users\public\cleanmgr.exe
- %TEMP%\bistningers\skintilvrelse.pre
- %TEMP%\bistningers\aneurismal\pencilernes\retenue\sports-wallpapers-1.jpg
- %TEMP%\nsm7bb5.tmp\system.dll
Network activity
Connects to
- '19#.#.176.146':80
TCP
HTTP GET requests
- http://19#.#.176.146/278/cleanmgr.exe
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
