Purpose: tsitra11.exe -

TSITRA1000106.EXE can also use the following file names:

• TSITRA[1].EXE
• TSITRA572.EXE
• TSITRA.EXE
• TSITRA801.EXE
• TSITRA77.EXE
• TSITRA27.EXE
• TSITRA2000218.EXE
• TSITRA333.EXE
• TSITRA1000137.EXE
• 79536423.EXE
• TSITRA2000340.EXE
• INFA2.TMP
• TSITRA922.EXE
• TSITRA1002397.EXE__DELETE_ON_REBOOT
• TSITRA801.EXE__DELETE_ON_REBOOT
• TSITRA450.EXE
• TSITRA1044.EXE
• TSITRA911.EXE
• TSITRA922.EXE__DELETE_ON_REBOOT
• TSITRA1000106.EXE__DELETE_ON_REBOOT
• 02155333.EXE
• TSITRA11.EXE
• 13048371.EXE
• TSITRA1000726.EXE
• TSITRA11.EXE__DELETE_ON_REBOOT
• TSITRA2000373.EXE
• 73675891.EXE
• 59619229.EXE
• 77351827.DAT
• TSITRA356.EXE
• TSITRA2000382.EXE
• TSITRA904.EXE
• TSITRA2000413.EXE
• TSITRA392.EXE
• 41876623.EXE
• TSITRA72.EXE
• TSITRA937.EXE
• 72957404.EXE
• TSITRA1000140.EXE__DELETE_ON_REBOOT
• TSITRA1000140.EXE
• 27752369.EXE
• 03625918.EXE
• A0084342.EXE
• TSITRA2000201.EXE
• 78947838.EXE
• TSITRA33.EXE
• A0035314.EXE
• TSITRA1077.EXE
• 79306094.DAT
• TSITRA[2].EXE
• 29813975.EXE
• 22372177.EXE
• 52685485.EXE
• 18341233.EXE
• TSITRA2000373.EXE__DELETE_ON_REBOOT
• TSITRA1000627.EXE__DELETE_ON_REBOOT
• TSITRA779.EXE
• TSITRA1000106.EXE.TMP
• SAS.EXE
• 51073974.EXE
• 89625476.EXE
• TSITRA1000627.EXE
• 05106155.EXE
• TSITRA1061.EXE
• 37688792.EXE
• 51183926.EXE
• TSITRA2000206.EXE
• TSITRA2000382.EXE__DELETE_ON_REBOOT
• 73212084.EXE
• TSITRA1000106 000.000EXE000
• TSITRA572 000.000EXE000
• TSITRA2000139.EXE
• TSITRA27.EXE.TMP
• 26098714.EXE
• 90678766.EXE
• 26288103.EXE
• 14325941.EXE
• TSITRA387.EXE
• 97654504.EXE

The filename TSITRA1000106.EXE refers to mutiple instances of an executable program.

The most common file size is 35,840 bytes. But the following file size has also been seen:

• 45,056 bytes

The unsafe files using this name are associated with the malware group TROJAN.AGENT.GEN.

These files may have the following Vendor, Product, Version Information in the file header ; ; 0, 0, 0, 0

• The following Vendor, Product, Version Information has also been reported:

; ; 1, 1, 0, 2

TSITRA1000106.EXE has been seen to perform the following behavior(s):

• The Process is packed and/or encrypted using a software packing process
• Adds a Registry Key (RUN) to auto start Programs on system start up
• This Process Deletes Other Processes From Disk
• This Process Creates Other Processes On Disk
• Can communicate with other computer systems using HTTP protocols
• Executes a Process
• Registers a Dynamic Link Library File
• Writes to another Process's Virtual Memory (Process Hijacking)

TSITRA1000106.EXE has been the subject of the following behavior(s):

• Created as a process on disk
• Executed as a Process
• Writes to another Process's Virtual Memory (Process Hijacking)
• Added as a Registry auto start to load Program on Boot up
• Deleted as a process from disk
• Terminated as a Process