Associated Malware Groups
The filename is associated with the malware groups:
- Worm
- Cloaked Malware
- Malware Downloader
File Behavior
~TMPC.EXE has been seen to perform the following behavior:
- Uses hidden browser windows to connect to web sites without telling you
- Creates system tray popups, messages, errors and security warnings
- Opens browser pop ups
- Runs Javascript code
- Creates, modifies or schedules batch jobs
- Executes a Process
- Copies files
- This Process Deletes Other Processes From Disk
- Registers a Dynamic Link Library File
- Can communicate with other computer systems using HTTP protocols
- The Process is packed and/or encrypted using a software packing process
- This process creates other processes on disk
- Writes to another Process's Virtual Memory (Process Hijacking)
~TMPC.EXE has been the subject of the following behavior:
- Created as a process on disk
- Copied to multiple locations on the system
- Deleted as a process from disk
- Executed as a Process
- Executed from Temporary Folders
- Registered as a Dynamic Link Library File
- Has code inserted into its Virtual Memory space by other programs
- Terminated as a Process
- Added as a Registry auto start to load Program on Boot up
Country Of Origin
The filename ~TMPC.EXE was first seen on Oct 20 2008 in the following geographical regions of the Prevx community:
- SPAIN on Oct 20 2008
- GERMANY on Nov 10 2008
- The UNITED ARAB EMIRATES on Dec 7 2008
- The UNITED STATES on Jan 8 2009
File Name Aliases
~TMPC.EXE can also use the following file names:
- ~TMPA.EXE
- 53792032.EXE
- 62294017.TXT
- ~TMPD.EXE
- ~TMPK.EXE
- 49471808.DAT
- J.EXE
- D9.EXE
- F.EXE
- D.EXE
- A.EXE
- ~TMPF.EXE
- 84032382.EXE
- 30004841.EXE
- 01592088.EXE
- 07954116.DAT
- 96449546.DAT
Filesizes
The following file size has been seen:
- 81,920 bytes
- 65,536 bytes
- 87,040 bytes
- 95,236 bytes
- 172,036 bytes
File Type
The filename ~TMPC.EXE refers to many versions of an executable program.
File Activity
One or more files with the name ~TMPC.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\docume~1\user\locals~1\temp\4798_appcompat.txt
- Creates c:\docume~1\user\locals~1\temp\14A91.dmp
- Opens/modifes c:\autoexec.bat
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.