Technical Information
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cscript.exe
- <Auxiliary element>
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
a large number of user processes.