Associated Malware Groups
The filename is associated with the malware groups:
- Malware Downloader
- Malware Dropper
- Malicious Software
File Behavior
MROFINU1001186.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Adds a Registry Key (RUN) to auto start Programs on system start up
- This Process Deletes Other Processes From Disk
- This process creates other processes on disk
- Executes a Process
- Writes to another Process's Virtual Memory (Process Hijacking)
- Can communicate with other computer systems using HTTP protocols
- Registers a Dynamic Link Library File
- Injects code into other processes
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Uses DNS to retrieve the IP address for web sites
- Uses your PC to connect to Chat rooms
- The Process is polymorphic and can change its structure
MROFINU1001186.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Added as a Registry auto start to load Program on Boot up
- Registered as a Dynamic Link Library File
Country Of Origin
The filename MROFINU1001186.EXE was first seen on Apr 3 2008 in the following geographical regions of the Prevx community:
- The UNITED STATES on Apr 3 2008
- SPAIN on Apr 3 2008
- The EUROPEAN UNION on Apr 12 2008
- The UNITED KINGDOM on Apr 24 2008
File Name Aliases
MROFINU1001186.EXE can also use the following file names:
- MROFINU1645.EXE
- 39181321.DAT
- 77159063.SVD
- MROFINU.EXE
- MROFINU1535.EXE
- 17PHOLMES27.EXE
- MROFINU27.EXE
- 17PHOLMES1000106.EXE
- 17PHOLMES572.EXE
- MROFINU572.EXE
- MROFINU1000106.EXE
- MROFINU1188.EXE
- 57995614.DAT
- MROFINU922.EXE
- 90560171.DAT
- MROFINU72.EXE
- 21349272.EXE
- 17PHOLMES1615.EXE
- MROFINU1615.EXE
- 17PHOLMES1001186.EXE
- 17PHOLMES1535.EXE
- 17PHOLMES1188.EXE
- MROFINU1228.EXE
- MROFINU1188.EXE.TMP
- MROFINU1000137.EXE.TMP
- 30487903.SVD
- 80936131.SVD
- MROFINU1000137.EXE
- MROFINU1423.EXE
- MROFINU2000352.EXE
- MROFINU1864.EXE
- MROFINU1148.EXE
Filesizes
The following file size has been seen:
- 37,376 bytes
- 47,104 bytes
- 41,984 bytes
- 48,128 bytes
File Type
The filename MROFINU1001186.EXE refers to many versions of an executable program.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.