Technical Information
Modifies file system
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc stop policyagent' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop netsvcs_0x2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete netsvcs_0x0' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop netsvcs_0x0' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete netsvcs_0x1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop netsvcs_0x1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete ias' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop ias' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete 6to4' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop 6to4' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Microsoft MX2008"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zxbljeyr' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop "Microsoft MX2008"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zxbljeyr' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zrhbuicb' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zrhbuicb' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zqlfavyu' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zqlfavyu' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete netsvcs_0x2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc stop policyagent
- '%WINDIR%\syswow64\sc.exe' stop "Microsoft MX2008"
- '%WINDIR%\syswow64\cmd.exe' /c sc stop netsvcs_0x2
- '%WINDIR%\syswow64\cmd.exe' /c sc delete netsvcs_0x2
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"
- '%WINDIR%\syswow64\sc.exe' delete zrhbuicb
- '%WINDIR%\syswow64\sc.exe' stop zxbljeyr
- '%WINDIR%\syswow64\sc.exe' delete zxbljeyr
- '%WINDIR%\syswow64\sc.exe' delete ias
- '%WINDIR%\syswow64\sc.exe' delete netsvcs_0x2
- '%WINDIR%\syswow64\sc.exe' delete netsvcs_0x1
- '%WINDIR%\syswow64\sc.exe' delete 6to4
- '%WINDIR%\syswow64\sc.exe' delete netsvcs_0x0
- '%WINDIR%\syswow64\sc.exe' stop netsvcs_0x0
- '%WINDIR%\syswow64\sc.exe' stop 6to4
- '%WINDIR%\syswow64\sc.exe' stop ias
- '%WINDIR%\syswow64\sc.exe' stop netsvcs_0x1
- '%WINDIR%\syswow64\cmd.exe' /c sc delete netsvcs_0x0
- '%WINDIR%\syswow64\sc.exe' delete "Microsoft MX2008"
- '%WINDIR%\syswow64\cmd.exe' /c sc stop netsvcs_0x0
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Microsoft MX2008"
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zqlfavyu
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zqlfavyu
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zrhbuicb
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zrhbuicb
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zxbljeyr
- '%WINDIR%\syswow64\cmd.exe' /c sc stop "Microsoft MX2008"
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zxbljeyr
- '%WINDIR%\syswow64\sc.exe' delete zqlfavyu
- '%WINDIR%\syswow64\cmd.exe' /c sc stop netsvcs_0x1
- '%WINDIR%\syswow64\sc.exe' stop zqlfavyu
- '%WINDIR%\syswow64\sc.exe' stop policyagent
- '%WINDIR%\syswow64\cmd.exe' /c sc stop 6to4
- '%WINDIR%\syswow64\sc.exe' stop zrhbuicb
- '%WINDIR%\syswow64\cmd.exe' /c sc delete 6to4
- '%WINDIR%\syswow64\cmd.exe' /c sc stop ias
- '%WINDIR%\syswow64\cmd.exe' /c sc delete ias
- '%WINDIR%\syswow64\cmd.exe' /c sc delete netsvcs_0x1
- '%WINDIR%\syswow64\sc.exe' stop netsvcs_0x2
