Trojan.Siggen18.49795

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\rthdvbg_firewall_xx

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\RtHDVBgGJ] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RtHDVBgGJ] 'ImagePath' = '<SYSTEM32>\srvany.exe'

Creates the following services

'RtHDVBgGJ' <SYSTEM32>\srvany.exe

Modifies file system

Creates the following files

%WINDIR%\temp\vbdllbak\rthdvbg_firewall_xx.xml
%WINDIR%\servicing\powerrun\sdelete.exe
%WINDIR%\servicing\powerrun\powerrun.exe
%WINDIR%\temp\autd125.tmp
%WINDIR%\temp\autd115.tmp
%WINDIR%\temp\2g5w3a2e.tmp
%WINDIR%\temp\autd0f5.tmp
%WINDIR%\temp\autb7ad.tmp
%WINDIR%\temp\autb7ac.tmp
%WINDIR%\temp\2sii9r7i.tmp
%WINDIR%\temp\autb79b.tmp
%WINDIR%\servicing\rthdvbg\kaijidaima.bak
%TEMP%\autb118.tmp
%TEMP%\2g6r4v0m.tmp
%TEMP%\autb0f7.tmp
%WINDIR%\temp\vbdllbak\czwj.vbs
%WINDIR%\kaijidaima.exe
%WINDIR%\syswow64\startmenu.vbs
%WINDIR%\temp\vbdllbak\sdelete.exe
%WINDIR%\syswow64\instsrv.exe
%WINDIR%\syswow64\srvany.exe
%WINDIR%\temp\vbdllbak\setacl.exe
%WINDIR%\temp\vbdllbak\powerrun.exe
%TEMP%\autb107.tmp
%WINDIR%\servicing\sessions\2022-7211300.xml

Sets the 'hidden' attribute to the following files

%WINDIR%\kaijidaima.exe
%WINDIR%\syswow64\srvany.exe
%WINDIR%\syswow64\instsrv.exe

Deletes the following files

%TEMP%\autb0f7.tmp
%WINDIR%\tezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
%WINDIR%\tezzzzzzzzzzzzzzzzzzzz.zzz
%WINDIR%\tezzzzzzzzzzzzzzzz.zzz
%WINDIR%\temp\2g5w3a2e.tmp
%WINDIR%\temp\autd125.tmp
%WINDIR%\temp\autd115.tmp
%WINDIR%\tezzzzzzzzzzzzzzzzzzz.zzz
%WINDIR%\temp\autd0f5.tmp
%WINDIR%\temp\autb7ad.tmp
%WINDIR%\temp\autb7ac.tmp
%WINDIR%\temp\autb79b.tmp
%TEMP%\2g6r4v0m.tmp
%TEMP%\autb118.tmp
%TEMP%\autb107.tmp
%WINDIR%\temp\2sii9r7i.tmp
%WINDIR%\tezzzzzzzzzzzzzzzzzz.zzz

Moves the following files

from %WINDIR%\temp\vbdllbak\czwj.vbs to %WINDIR%\teaaaaaaaaaaaaaaaa.aaa
from %WINDIR%\teppppppppppppppppppp.ppp to %WINDIR%\teqqqqqqqqqqqqqqqqqqq.qqq
from %WINDIR%\teooooooooooooooooooo.ooo to %WINDIR%\teppppppppppppppppppp.ppp
from %WINDIR%\tennnnnnnnnnnnnnnnnnn.nnn to %WINDIR%\teooooooooooooooooooo.ooo
from %WINDIR%\temmmmmmmmmmmmmmmmmmm.mmm to %WINDIR%\tennnnnnnnnnnnnnnnnnn.nnn
from %WINDIR%\telllllllllllllllllll.lll to %WINDIR%\temmmmmmmmmmmmmmmmmmm.mmm
from %WINDIR%\tekkkkkkkkkkkkkkkkkkk.kkk to %WINDIR%\telllllllllllllllllll.lll
from %WINDIR%\tejjjjjjjjjjjjjjjjjjj.jjj to %WINDIR%\tekkkkkkkkkkkkkkkkkkk.kkk
from %WINDIR%\teiiiiiiiiiiiiiiiiiii.iii to %WINDIR%\tejjjjjjjjjjjjjjjjjjj.jjj
from %WINDIR%\tehhhhhhhhhhhhhhhhhhh.hhh to %WINDIR%\teiiiiiiiiiiiiiiiiiii.iii
from %WINDIR%\teggggggggggggggggggg.ggg to %WINDIR%\tehhhhhhhhhhhhhhhhhhh.hhh
from %WINDIR%\tefffffffffffffffffff.fff to %WINDIR%\teggggggggggggggggggg.ggg
from %WINDIR%\teeeeeeeeeeeeeeeeeeee.eee to %WINDIR%\tefffffffffffffffffff.fff
from %WINDIR%\teddddddddddddddddddd.ddd to %WINDIR%\teeeeeeeeeeeeeeeeeeee.eee
from %WINDIR%\terrrrrrrrrrrrrrrrrrr.rrr to %WINDIR%\tesssssssssssssssssss.sss
from %WINDIR%\teqqqqqqqqqqqqqqqqqqq.qqq to %WINDIR%\terrrrrrrrrrrrrrrrrrr.rrr
from %WINDIR%\teaaaaaaaaaaaaaaaaaaa.aaa to %WINDIR%\tebbbbbbbbbbbbbbbbbbb.bbb
from %WINDIR%\temp\vbdllbak\sdelete.exe to %WINDIR%\teaaaaaaaaaaaaaaaaaaa.aaa
from %WINDIR%\teyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy to %WINDIR%\tezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
from %WINDIR%\texxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx to %WINDIR%\teyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
from %WINDIR%\tewwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www to %WINDIR%\texxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
from %WINDIR%\tevvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv to %WINDIR%\tewwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
from %WINDIR%\teuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu to %WINDIR%\tevvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
from %WINDIR%\tettttttttttttttttttttttttttttttt.ttt to %WINDIR%\teuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
from %WINDIR%\tesssssssssssssssssssssssssssssss.sss to %WINDIR%\tettttttttttttttttttttttttttttttt.ttt
from %WINDIR%\terrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr to %WINDIR%\tesssssssssssssssssssssssssssssss.sss
from %WINDIR%\teqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq to %WINDIR%\terrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
from %WINDIR%\teppppppppppppppppppppppppppppppp.ppp to %WINDIR%\teqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
from %WINDIR%\teooooooooooooooooooooooooooooooo.ooo to %WINDIR%\teppppppppppppppppppppppppppppppp.ppp
from %WINDIR%\teccccccccccccccccccc.ccc to %WINDIR%\teddddddddddddddddddd.ddd
from %WINDIR%\teffffffffffffffffffff.fff to %WINDIR%\tegggggggggggggggggggg.ggg
from %WINDIR%\tesssssssssssssssssss.sss to %WINDIR%\tettttttttttttttttttt.ttt
from %WINDIR%\tewwwwwwwwwwwwwwwwww.www to %WINDIR%\texxxxxxxxxxxxxxxxxx.xxx
from %WINDIR%\tevvvvvvvvvvvvvvvvvv.vvv to %WINDIR%\tewwwwwwwwwwwwwwwwww.www
from %WINDIR%\teuuuuuuuuuuuuuuuuuu.uuu to %WINDIR%\tevvvvvvvvvvvvvvvvvv.vvv
from %WINDIR%\tetttttttttttttttttt.ttt to %WINDIR%\teuuuuuuuuuuuuuuuuuu.uuu
from %WINDIR%\tessssssssssssssssss.sss to %WINDIR%\tetttttttttttttttttt.ttt
from %WINDIR%\terrrrrrrrrrrrrrrrrr.rrr to %WINDIR%\tessssssssssssssssss.sss
from %WINDIR%\teqqqqqqqqqqqqqqqqqq.qqq to %WINDIR%\terrrrrrrrrrrrrrrrrr.rrr
from %WINDIR%\tepppppppppppppppppp.ppp to %WINDIR%\teqqqqqqqqqqqqqqqqqq.qqq
from %WINDIR%\teoooooooooooooooooo.ooo to %WINDIR%\tepppppppppppppppppp.ppp
from %WINDIR%\tennnnnnnnnnnnnnnnnn.nnn to %WINDIR%\teoooooooooooooooooo.ooo
from %WINDIR%\temmmmmmmmmmmmmmmmmm.mmm to %WINDIR%\tennnnnnnnnnnnnnnnnn.nnn
from %WINDIR%\tellllllllllllllllll.lll to %WINDIR%\temmmmmmmmmmmmmmmmmm.mmm
from %WINDIR%\tekkkkkkkkkkkkkkkkkk.kkk to %WINDIR%\tellllllllllllllllll.lll
from %WINDIR%\tejjjjjjjjjjjjjjjjjj.jjj to %WINDIR%\tekkkkkkkkkkkkkkkkkk.kkk
from %WINDIR%\teiiiiiiiiiiiiiiiiii.iii to %WINDIR%\tejjjjjjjjjjjjjjjjjj.jjj
from %WINDIR%\tehhhhhhhhhhhhhhhhhh.hhh to %WINDIR%\teiiiiiiiiiiiiiiiiii.iii
from %WINDIR%\tegggggggggggggggggg.ggg to %WINDIR%\tehhhhhhhhhhhhhhhhhh.hhh
from %WINDIR%\teffffffffffffffffff.fff to %WINDIR%\tegggggggggggggggggg.ggg
from %WINDIR%\teeeeeeeeeeeeeeeeeee.eee to %WINDIR%\teffffffffffffffffff.fff
from %WINDIR%\tedddddddddddddddddd.ddd to %WINDIR%\teeeeeeeeeeeeeeeeeee.eee
from %WINDIR%\tecccccccccccccccccc.ccc to %WINDIR%\tedddddddddddddddddd.ddd
from %WINDIR%\tebbbbbbbbbbbbbbbbbb.bbb to %WINDIR%\tecccccccccccccccccc.ccc
from %WINDIR%\teaaaaaaaaaaaaaaaaaa.aaa to %WINDIR%\tebbbbbbbbbbbbbbbbbb.bbb
from %WINDIR%\temp\vbdllbak\setacl.exe to %WINDIR%\teaaaaaaaaaaaaaaaaaa.aaa
from %WINDIR%\teyyyyyyyyyyyyyyyyyyy.yyy to %WINDIR%\tezzzzzzzzzzzzzzzzzzz.zzz
from %WINDIR%\texxxxxxxxxxxxxxxxxxx.xxx to %WINDIR%\teyyyyyyyyyyyyyyyyyyy.yyy
from %WINDIR%\tewwwwwwwwwwwwwwwwwww.www to %WINDIR%\texxxxxxxxxxxxxxxxxxx.xxx
from %WINDIR%\tevvvvvvvvvvvvvvvvvvv.vvv to %WINDIR%\tewwwwwwwwwwwwwwwwwww.www
from %WINDIR%\teuuuuuuuuuuuuuuuuuuu.uuu to %WINDIR%\tevvvvvvvvvvvvvvvvvvv.vvv
from %WINDIR%\tennnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn to %WINDIR%\teooooooooooooooooooooooooooooooo.ooo
from %WINDIR%\tebbbbbbbbbbbbbbbbbbb.bbb to %WINDIR%\teccccccccccccccccccc.ccc
from %WINDIR%\temmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm to %WINDIR%\tennnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
from %WINDIR%\telllllllllllllllllllllllllllllll.lll to %WINDIR%\temmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
from %WINDIR%\tekkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk to %WINDIR%\telllllllllllllllllllllllllllllll.lll
from %WINDIR%\teoooooooooooooooo.ooo to %WINDIR%\tepppppppppppppppp.ppp
from %WINDIR%\tebbbbbbbbbbbbbbbbbbbb.bbb to %WINDIR%\tecccccccccccccccccccc.ccc
from %WINDIR%\teaaaaaaaaaaaaaaaaaaaa.aaa to %WINDIR%\tebbbbbbbbbbbbbbbbbbbb.bbb
from %WINDIR%\temp\vbdllbak\powerrun.exe to %WINDIR%\teaaaaaaaaaaaaaaaaaaaa.aaa
from %WINDIR%\teyyyyyyyyyyyyyyyy.yyy to %WINDIR%\tezzzzzzzzzzzzzzzz.zzz
from %WINDIR%\texxxxxxxxxxxxxxxx.xxx to %WINDIR%\teyyyyyyyyyyyyyyyy.yyy
from %WINDIR%\tewwwwwwwwwwwwwwww.www to %WINDIR%\texxxxxxxxxxxxxxxx.xxx
from %WINDIR%\tevvvvvvvvvvvvvvvv.vvv to %WINDIR%\tewwwwwwwwwwwwwwww.www
from %WINDIR%\teuuuuuuuuuuuuuuuu.uuu to %WINDIR%\tevvvvvvvvvvvvvvvv.vvv
from %WINDIR%\tetttttttttttttttt.ttt to %WINDIR%\teuuuuuuuuuuuuuuuu.uuu
from %WINDIR%\tessssssssssssssss.sss to %WINDIR%\tetttttttttttttttt.ttt
from %WINDIR%\terrrrrrrrrrrrrrrr.rrr to %WINDIR%\tessssssssssssssss.sss
from %WINDIR%\teqqqqqqqqqqqqqqqq.qqq to %WINDIR%\terrrrrrrrrrrrrrrr.rrr
from %WINDIR%\tepppppppppppppppp.ppp to %WINDIR%\teqqqqqqqqqqqqqqqq.qqq
from %WINDIR%\tennnnnnnnnnnnnnnn.nnn to %WINDIR%\teoooooooooooooooo.ooo
from %WINDIR%\tedddddddddddddddddddd.ddd to %WINDIR%\teeeeeeeeeeeeeeeeeeeee.eee
from %WINDIR%\temmmmmmmmmmmmmmmm.mmm to %WINDIR%\tennnnnnnnnnnnnnnn.nnn
from %WINDIR%\tellllllllllllllll.lll to %WINDIR%\temmmmmmmmmmmmmmmm.mmm
from %WINDIR%\tekkkkkkkkkkkkkkkk.kkk to %WINDIR%\tellllllllllllllll.lll
from %WINDIR%\tejjjjjjjjjjjjjjjj.jjj to %WINDIR%\tekkkkkkkkkkkkkkkk.kkk
from %WINDIR%\teiiiiiiiiiiiiiiii.iii to %WINDIR%\tejjjjjjjjjjjjjjjj.jjj
from %WINDIR%\tehhhhhhhhhhhhhhhh.hhh to %WINDIR%\teiiiiiiiiiiiiiiii.iii
from %WINDIR%\tegggggggggggggggg.ggg to %WINDIR%\tehhhhhhhhhhhhhhhh.hhh
from %WINDIR%\teffffffffffffffff.fff to %WINDIR%\tegggggggggggggggg.ggg
from %WINDIR%\teeeeeeeeeeeeeeeee.eee to %WINDIR%\teffffffffffffffff.fff
from %WINDIR%\tedddddddddddddddd.ddd to %WINDIR%\teeeeeeeeeeeeeeeee.eee
from %WINDIR%\tecccccccccccccccc.ccc to %WINDIR%\tedddddddddddddddd.ddd
from %WINDIR%\tebbbbbbbbbbbbbbbb.bbb to %WINDIR%\tecccccccccccccccc.ccc
from %WINDIR%\teaaaaaaaaaaaaaaaa.aaa to %WINDIR%\tebbbbbbbbbbbbbbbb.bbb
from %WINDIR%\texxxxxxxxxxxxxxxxxx.xxx to %WINDIR%\teyyyyyyyyyyyyyyyyyy.yyy
from %WINDIR%\tettttttttttttttttttt.ttt to %WINDIR%\teuuuuuuuuuuuuuuuuuuu.uuu
from %WINDIR%\teeeeeeeeeeeeeeeeeeeee.eee to %WINDIR%\teffffffffffffffffffff.fff
from %WINDIR%\tehhhhhhhhhhhhhhhhhhhh.hhh to %WINDIR%\teiiiiiiiiiiiiiiiiiiii.iii
from %WINDIR%\tecccccccccccccccccccc.ccc to %WINDIR%\tedddddddddddddddddddd.ddd
from %WINDIR%\tejjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj to %WINDIR%\tekkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
from %WINDIR%\teiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii to %WINDIR%\tejjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
from %WINDIR%\tehhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh to %WINDIR%\teiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
from %WINDIR%\teggggggggggggggggggggggggggggggg.ggg to %WINDIR%\tehhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
from %WINDIR%\tefffffffffffffffffffffffffffffff.fff to %WINDIR%\teggggggggggggggggggggggggggggggg.ggg
from %WINDIR%\teeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee to %WINDIR%\tefffffffffffffffffffffffffffffff.fff
from %WINDIR%\teddddddddddddddddddddddddddddddd.ddd to %WINDIR%\teeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
from %WINDIR%\teccccccccccccccccccccccccccccccc.ccc to %WINDIR%\teddddddddddddddddddddddddddddddd.ddd
from %WINDIR%\tebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb to %WINDIR%\teccccccccccccccccccccccccccccccc.ccc
from %WINDIR%\teaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa to %WINDIR%\tebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
from %WINDIR%\temp\vbdllbak\rthdvbg_firewall_xx.xml to %WINDIR%\teaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
from %WINDIR%\teyyyyyyyyyyyyyyyyyyyy.yyy to %WINDIR%\tezzzzzzzzzzzzzzzzzzzz.zzz
from %WINDIR%\texxxxxxxxxxxxxxxxxxxx.xxx to %WINDIR%\teyyyyyyyyyyyyyyyyyyyy.yyy
from %WINDIR%\tewwwwwwwwwwwwwwwwwwww.www to %WINDIR%\texxxxxxxxxxxxxxxxxxxx.xxx
from %WINDIR%\tevvvvvvvvvvvvvvvvvvvv.vvv to %WINDIR%\tewwwwwwwwwwwwwwwwwwww.www
from %WINDIR%\teuuuuuuuuuuuuuuuuuuuu.uuu to %WINDIR%\tevvvvvvvvvvvvvvvvvvvv.vvv
from %WINDIR%\tetttttttttttttttttttt.ttt to %WINDIR%\teuuuuuuuuuuuuuuuuuuuu.uuu
from %WINDIR%\tessssssssssssssssssss.sss to %WINDIR%\tetttttttttttttttttttt.ttt
from %WINDIR%\terrrrrrrrrrrrrrrrrrrr.rrr to %WINDIR%\tessssssssssssssssssss.sss
from %WINDIR%\teqqqqqqqqqqqqqqqqqqqq.qqq to %WINDIR%\terrrrrrrrrrrrrrrrrrrr.rrr
from %WINDIR%\tepppppppppppppppppppp.ppp to %WINDIR%\teqqqqqqqqqqqqqqqqqqqq.qqq
from %WINDIR%\teoooooooooooooooooooo.ooo to %WINDIR%\tepppppppppppppppppppp.ppp
from %WINDIR%\tennnnnnnnnnnnnnnnnnnn.nnn to %WINDIR%\teoooooooooooooooooooo.ooo
from %WINDIR%\temmmmmmmmmmmmmmmmmmmm.mmm to %WINDIR%\tennnnnnnnnnnnnnnnnnnn.nnn
from %WINDIR%\tellllllllllllllllllll.lll to %WINDIR%\temmmmmmmmmmmmmmmmmmmm.mmm
from %WINDIR%\tekkkkkkkkkkkkkkkkkkkk.kkk to %WINDIR%\tellllllllllllllllllll.lll
from %WINDIR%\tejjjjjjjjjjjjjjjjjjjj.jjj to %WINDIR%\tekkkkkkkkkkkkkkkkkkkk.kkk
from %WINDIR%\teiiiiiiiiiiiiiiiiiiii.iii to %WINDIR%\tejjjjjjjjjjjjjjjjjjjj.jjj
from %WINDIR%\tegggggggggggggggggggg.ggg to %WINDIR%\tehhhhhhhhhhhhhhhhhhhh.hhh
from %WINDIR%\teyyyyyyyyyyyyyyyyyy.yyy to %WINDIR%\tezzzzzzzzzzzzzzzzzz.zzz

Miscellaneous

Creates and executes the following

'%WINDIR%\temp\vbdllbak\powerrun.exe' %WINDIR%\temp\vbdllbak\czwj.vbs
'%WINDIR%\syswow64\instsrv.exe' RtHDVBgGJ <SYSTEM32>\srvany.exe
'%WINDIR%\servicing\powerrun\sdelete.exe' -s -p 3 %WINDIR%\temp\vbdllbak
'%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:administrators;p:read;m:set"
'%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:system;p:read;m:set"
'%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:users;p:read;m:set"
'%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\srvany.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"
'<SYSTEM32>\wscript.exe' "%WINDIR%\temp\vbdllbak\czwj.vbs"
'%WINDIR%\temp\vbdllbak\setacl.exe' -on "%WINDIR%\kaijidaima.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"
'%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setowner -ownr "n:nt service\trustedinstaller"
'%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:nt service\trustedinstaller;p:full;m:set"
'%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\instsrv.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"
'%WINDIR%\temp\vbdllbak\powerrun.exe' /TI/ %WINDIR%\temp\vbdllbak\czwj.vbs
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /delete /tn "\RtHDVBg_firewall_xx" /f' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /delete /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /f' (with hidden window)
'%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\instsrv.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"' (with hidden window)
'%WINDIR%\syswow64\instsrv.exe' RtHDVBgGJ <SYSTEM32>\srvany.exe' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /xml "%WINDIR%\temp\vbdllbak\RtHDVBg_firewall_xx.xml" /f' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r users:rx' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r Administrators:rx' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r Administrators:rx' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r Administrators:rx' (with hidden window)
'%WINDIR%\temp\vbdllbak\setacl.exe' -on "%WINDIR%\kaijidaima.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r users:rx' (with hidden window)
'%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\srvany.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"' (with hidden window)
'%WINDIR%\temp\vbdllbak\powerrun.exe' %WINDIR%\temp\vbdllbak\czwj.vbs' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r users:rx' (with hidden window)
'%WINDIR%\syswow64\sc.exe' sdset RtHDVBgGJ D:AR(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)' (with hidden window)
'%WINDIR%\servicing\powerrun\sdelete.exe' -s -p 3 %WINDIR%\temp\vbdllbak' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cacls.exe' %WINDIR%\kaijidaima.exe /p system:r
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r Administrators:rx
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r users:rx
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f
'%WINDIR%\syswow64\cacls.exe' <SYSTEM32>\srvany.exe /p system:r
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r Administrators:rx
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r users:rx
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f
'%WINDIR%\syswow64\cacls.exe' <SYSTEM32>\instsrv.exe /p system:r
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r Administrators:rx
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r users:rx
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f
'%WINDIR%\syswow64\sc.exe' sdset RtHDVBgGJ D:AR(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
'%WINDIR%\syswow64\schtasks.exe' /delete /tn "\RtHDVBg_firewall_xx" /f
'%WINDIR%\syswow64\schtasks.exe' /delete /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /xml "%WINDIR%\temp\vbdllbak\RtHDVBg_firewall_xx.xml" /f

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial