Win32/PSW.WOW.NQK malicious file

The Win32/PSW.WOW.NQK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/PSW.WOW.NQK virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Authenticode signature is invalid

How to determine Win32/PSW.WOW.NQK?


File Info:
name: 9275E5A1F98455E677E3.mlw
path: /opt/CAPEv2/storage/binaries/ecd012f4de30874ff06f03628ae5b1f920df53b82d6457f696c581e4d1d781fc
crc32: E2D0E6D6
md5: 9275e5a1f98455e677e394245714242b
sha1: 60341158b9cac7ccb289b31ee3dd31c1b8c8be83
sha256: ecd012f4de30874ff06f03628ae5b1f920df53b82d6457f696c581e4d1d781fc
sha512: 75b522191ebd40500e09d611da4e9f8f1f01d7ad3b8ff39972b5e5f3d4c656b8b9514108ceb9af0a2cd38029451d79133cc352e41ebf8e53bde8c10bc3a8b822
ssdeep: 384:6VGTWaXxn/lwJlt/NRFx1NO2HhoPLpqMWdlds:6VYF+hNRP1NpH2pqMr
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T159A23C02E6D55EF1FA86067460AD3B7B657A087442485AF36FC6CA56093305FBD3EC13
sha3_384: fd09651fb4817ae9da6929c5118a322418c780c4afb58e1568339c618ed57464f2f386e2e48520bb83f4da73e97a34b2
ep_bytes: 558bec83ec4456ff15343040008bf08a
timestamp: 2010-05-12 11:41:39

Version Info:
0: [No Data]

Win32/PSW.WOW.NQK also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.lwtA
DrWeb	Trojan.MulDrop1.41618
MicroWorld-eScan	Gen:Trojan.Heur.RP.bmX@bi10sKj
FireEye	Generic.mg.9275e5a1f98455e6
ALYac	Gen:Trojan.Heur.RP.bmX@bi10sKj
Cylance	Unsafe
Sangfor	[ARMADILLO V1.71]
K7AntiVirus	Riskware ( 0015e4f11 )
Alibaba	TrojanPSW:Win32/GamerPWS.72b6411c
K7GW	Riskware ( 0015e4f11 )
Cybereason	malicious.1f9845
Arcabit	Trojan.Heur.RP.EEE86C
BitDefenderTheta	AI:Packer.4638859C1E
VirIT	Trojan.Win32.OLG.AKMH
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/PSW.WOW.NQK
TrendMicro-HouseCall	TSPY_GAMETHI.SMO
ClamAV	Win.Trojan.Wow-1583
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Trojan.Heur.RP.bmX@bi10sKj
NANO-Antivirus	Trojan.Win32.OnLineGames.vtzzb
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Obfuscator.Hryj
Ad-Aware	Gen:Trojan.Heur.RP.bmX@bi10sKj
Emsisoft	Gen:Trojan.Heur.RP.bmX@bi10sKj (B)
Comodo	TrojWare.Win32.Magania.~I@f80td
Zillya	Trojan.OnLineGames.Win32.55283
TrendMicro	TSPY_GAMETHI.SMO
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-R
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/PSW.WOW.cla
Avira	HEUR/AGEN.1234243
MAX	malware (ai score=100)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Trojan.Heur.RP.bmX@bi10sKj
Cynet	Malicious (score: 100)
McAfee	GenericRXAA-AA!9275E5A1F984
TACHYON	Trojan-PWS/W32.Small.22282
VBA32	BScope.Trojan.Hooker
APEX	Malicious
Rising	Stealer.WOW!8.46A (CLOUD)
Yandex	Trojan.GenAsa!3ifSMk5w/GY
Ikarus	Trojan-PSW
Fortinet	W32/OnLineGames.ZPU!tr.pws
AVG	Win32:Trojan-gen
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32/PSW.WOW.NQK?

Win32/PSW.WOW.NQK removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X