Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- C:\autouninstallnh60ca.txt
- <Current directory>\debuglog\<File name>debug.txt
Miscellaneous
Searches for the following windows
- ClassName: 'NHCAGuard' WindowName: ''
- ClassName: 'NHCAAgent' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAMain"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="AimsReqEnroll"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAWeLogMon"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAResMon"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="ResMonLauncher"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="smupt"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPCInfo"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCATrafficMon"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPatchAgent"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCADTAgent"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHMCRemote"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCARemote Tray Icon"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAMsn"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAFileProc"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPortBlock"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAAgent"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCASysMon"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAEnroll"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPktMon"
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\user32.dll,UpdatePerUserSystemParameters
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCADevBlock"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="ResMonLauncher"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAAgent"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAMsn"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHMCRemote"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAMain"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="AimsReqEnroll"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCADevBlock"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAWeLogMon"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAResMon"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCADTAgent"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPatchAgent"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPCInfo"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPktMon"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAFileProc"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAEnroll"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCAPortBlock"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCARemote Tray Icon"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="smupt"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCASysMon"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="NHCATrafficMon"' (with hidden window)
