The file MSASCUI.EXE is identified as a virus dropper.
The dropper MSASCUI.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file MSASCUI.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the MSASCUI.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the MSASCUI.EXE process and delete the file MSASCUI.EXE.
Malware Analysis of MSASCUI.EXE
Full path on a computer: %Temp%\MSASCui.exe
Detected by UnHackMe:
MSASCUI.EXE
Default location: %Temp%\MSASCui.exe
Removal Results: Success
Number of reboot: 1
MSASCUI.EXE is known as:
Trojan.Graftor, W32.Backdoor2.HQVO, HV_QHOST_CI20293E.RDXN, Win.Trojan.7499123, Trojan.Inject.enip, Trojan.DownLoader7.12538, BehavesLike.Malware.bsf (vs), Trojan.Banker.Qhost.xe, TrojanSpy:MSIL.VB.M, W32.Backdoor.PXIN-7076, Trojan.Swisyn, a variant of MSIL.Injector.ANV, PE:Trojan.Sulunch.6.665, W32.ZedoPoo.PEH.tr, ILCrypt.dropper
MSASCUI.EXE hash:
- MD5: ba0f2f83c6452cd78e9618387716d408
Registry:- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender: “%Temp%\MSASCui.exe”
Folders:- %Local Appdata%\Google\Chrome\User Data\Default\Extension State
- %Temp%\afolder
- %Temp%\ztmp
Files:- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a1
- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a2
- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a3
- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a4
- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a5
- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a6
- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a7
- %Local Appdata%\Google\Chrome\User Data\Default\Cache\f_0000a8
- %Local Appdata%\Google\Chrome\User Data\Default\Extension Rules\000028.log
- %Local Appdata%\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000027
- %Local Appdata%\Google\Chrome\User Data\Default\Local Storage\https_www.google.ru_0.localstorage
- %Local Appdata%\Google\Chrome\User Data\Default\Local Storage\https_www.google.ru_0.localstorage-journal
- %Local Appdata%\Google\Chrome\User Data\Default\Session Storage\000128.sst
- %Local Appdata%\Google\Chrome\User Data\Default\Session Storage\000129.log
- %Local Appdata%\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000127
- %Local Appdata%\Google\Chrome\User Data\Default\Extension State\000003.log
- %Local Appdata%\Google\Chrome\User Data\Default\Extension State\CURRENT
- %Local Appdata%\Google\Chrome\User Data\Default\Extension State\LOCK
- %Local Appdata%\Google\Chrome\User Data\Default\Extension State\LOG
- %Local Appdata%\Google\Chrome\User Data\Default\Extension State\MANIFEST-000002
- %Local Appdata%\Google\Chrome\User Data\Default\History Index 2013-08-journal
- %Local Appdata%\Google\Chrome\User Data\Default\History Index 2014-02
- %Local Appdata%\Google\Chrome\User Data\Default\History Index 2014-02-journal
- %Local Appdata%\Google\Chrome\User Data\lockfile
- %Temp%\afolder\KERNEL32.exe
- %Temp%\etilqs_F6lsIDGJbY3xfTT
- %Temp%\etilqs_MWP61v7Ljd7QNRh
- %Temp%\etilqs_UaY2BbMfvZNiYFS
- %Temp%\MSASCui.exe