The program 1234901.EXE is used for hidden penetration into PC and its remote administration.
UnHackMe is recommended as a reliable program for solving the problem with 1234901.EXE.
Download for free: http://www.unhackme.com
Malware Analysis of 1234901.EXE
Full path on a computer: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe
Detected by UnHackMe:
Item Name: shell
Author: Unknown
Related File: explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe
Type: User Shell
Item Name: taskman
Author: Unknown
Related File: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.EXE
Type: Winlogon System
Removal Results: Success
Number of reboot: 1
1234901.EXE is known as:
Backdoor.Gurl, Trojan.Agent.aaxv (v), Troj.Agent-AAXV, Backdoor.Azbreg.bqi, Worm[Net].Kolab, Trojan.Lethic.B, Trojan.Agent.Gen-Undef, Trojan.HmBlocker, W32.Trojan.WLUI-7811, BScope.Backdoor.IRCBot.2122, Win32.Lethic.AA, Trojan.Ircbrute, W32.Injector.AEJX.tr, Trj.Zbot.M
1234901.EXE hash:
- MD5: 2e6935495554ec904d37b90678449b12
Registry:- HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe”
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\1234901: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe”
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: “explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe”
Folders:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896
Files:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe
- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\Desktop.ini