Trojan Graftor – AdvTCApp.exe – ccb3a0d015bb05e9a1605d877a46d8f1

Trojan Graftor
Also known as: Adware Kraddare, Trojan CI
SHA256: a6217f8f4168d88c76b65e45a0a84835ddbe04d04a32d258e25f02fbcb0a9685
SHA1: 7c185e794b891aa12843b133e00db4290ffaf6e1
MD5: ccb3a0d015bb05e9a1605d877a46d8f1
File size: 581704 bytes

Created files:

%Program Files%\AdvTopC\AdvTCApp.exe – Trojan Graftor
%Program Files%\AdvTopC\TCCheckAgent.exe – Trojan Graftor
%Program Files%\AdvTopC\TCHelper.dll – Trojan Graftor
%Program Files%\AdvTopC\TCUnins.exe – Trojan Graftor

Trojan Graftor created autostart registry keys:

HKLM\Software\Classes\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\InprocServer32 : %Program Files%\AdvTopC\TCHelper.dll
HKLM\Software\Classes\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\InprocServer32\ThreadingModel: Apartment
HKLM\System\CurrentControlSet\Services\TCCheckAgent\Type: 10010000
HKLM\System\CurrentControlSet\Services\TCCheckAgent\Start: 02000000
HKLM\System\CurrentControlSet\Services\TCCheckAgent\DisplayName: TCCheckAgent
HKLM\System\CurrentControlSet\Services\TCCheckAgent\ImagePath: %Program Files%\AdvTopC\TCCheckAgent.exe