JS.Siggen3.29386

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'Client Server Runtime Subsystem' = '"%ALLUSERSPROFILE%\Application Data\Windows\csrss.exe"'

Malicious functions

Creates and executes the following

'%TEMP%\rad69787.tmp'

Modifies file system

Creates the following files

%TEMP%\rad69787.tmp
%ALLUSERSPROFILE%\application data\windows\csrss.exe
%TEMP%\6893a5~1\state.tmp
%TEMP%\6893a5~1\unverified-microdesc-consensus.tmp
%TEMP%\6893a5~1\cached-certs.tmp
%TEMP%\6893a5~1\cached-microdesc-consensus.tmp
%TEMP%\6893a5~1\cached-microdescs.new

Deletes the following files

%TEMP%\6893a5~1\unverified-microdesc-consensus
%TEMP%\6893a5~1\state

Moves the following files

from %TEMP%\6893a5~1\state.tmp to %TEMP%\6893a5~1\state
from %TEMP%\omni.ja_20150820125829.zip to %TEMP%\w3z6a7qhit-i6t9ojps5nx8xulz2looa2z9jujwj-rhzzk0a196b9lnditdfmkcvfnzfh2k1s9yod46jmrvkgg==.94ecc6bc932e85461504.crypted000007
from %TEMP%\omni.ja_20150820130017.zip to %TEMP%\fuk9rq0d-c9phi8v0++kql5kwfvt4b1tff08ycmkb9uya4jxyobukdyl8dtedbuct-ex2is7wzmzpnhjvclibw==.94ecc6bc932e85461504.crypted000007
from %TEMP%\wallpaper.bmp to %TEMP%\uatpzdmqjuxz6nl9+ukx05hggpslrpctl-p5duo8tic=.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@2296-1056-1.log to %TEMP%\2.9.0.1467 (partner)\lgtm-xbjg0inhw7vlodbkwai77sw0vnt-skmjpyqejf61pruxlce+tbvfrahdm6tlygvsakgjfxymjc3vpqovq==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@2296-1128-1.log to %TEMP%\2.9.0.1467 (partner)\4rosefsvbf7mguuoahfx+6qiihtahw9povakk4uwne0z2seakaqbc39nguitt5rffkkrak1cc8qatgj3bhzraq==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@2296-2980-1.log to %TEMP%\2.9.0.1467 (partner)\qbv4v5l3xjrl9yk5fn+axdkkowwnqzbyredfajkk+owjzfhh8erkrvzerdqmbuuuckd7zdjgbunqobhh-nrpza==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@2296-3304-1.log to %TEMP%\2.9.0.1467 (partner)\chibetzbpunyejrqxcec9bu9munutyzaclrz-vxgmmdszmiblqpz6ouvh4id7youxqbrqryghelky05nnw0ylw==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@2296-348-1.log to %TEMP%\2.9.0.1467 (partner)\4jk9xghnzdtmrtim+cdntmbdrs7r7+xnucee9vdegfchadl2frwiiscmyfmrdjvqcpbevoj0ku5sefrqfrs+ma==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@2296-3584-1.log to %TEMP%\2.9.0.1467 (partner)\qz274exbjp+5mzf3p0skxux0oipgadim29ev75jg7vj2nalpp+hibuzjuhmwx6hyvbhog+rep4z8fhn31kjepg==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@3176-1704-1.log to %TEMP%\2.9.0.1467 (partner)\cx+twogu8mghgmdjzy21eatnabalhikcng85oaymhuq3amusvdzjxturuyi6bidmalaoa6fz7h9dskfwsqkjaa==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@3176-3792-1.log to %TEMP%\2.9.0.1467 (partner)\0iucfou-d2zq0w41spd6f4oydgrphl4ku+n97foxlouzlw5ubvirdgsyjrvk6q7vrixfbfsvyadkxmxzgec+aw==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@3176-3852-1.log to %TEMP%\2.9.0.1467 (partner)\uhaeshym9autfkrtzujpvs+bukrgdjyqcxvvsidruffpi5exlc846sgyvtnkzzlgbe-c6yeletatopznkm8myq==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@3176-3864-1.log to %TEMP%\2.9.0.1467 (partner)\wrshc0vws1ix-1mcdd-sjon0vnaxbyncwf72xnmw08zq4su2eoycrrde4yk57rln9-ixzy+o7nsanmqa+a1yma==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@3176-3884-1.log to %TEMP%\2.9.0.1467 (partner)\8vajhfyojw3xa+ii01kvnfhnhxoa7z+h1erggxbsjut3ykp2tfntw7fxufve32uiiktckyjxh-hwkcg+b1gelg==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\msiexec.exe@3176-3888-1.log to %TEMP%\2.9.0.1467 (partner)\-v8w5rjwszxptgvnvqh1suyjlwdyo+ujc3nqpyeddvbfma9ukljspbumlmvx3h1irj+2thaduk0-uugeq8qatg==.94ecc6bc932e85461504.crypted000007
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150820_123340645.html to %TEMP%\bmr5duknxvgnc--out-xjoxubrz21qhxyotihiuwnq6kdy0pq-8wwazmc7wcom-+eym9wful+xndcgw0jx5mtcz25yv4vyeskim-uxyfy4efh0p1cipbdbmt4grzpxcvxfvnqzcf5o33hlda9-wlk4jnr+n22vqkbzacol920swxmrryx07nlh8xcd...
from %TEMP%\microsoft .net framework 4.5.2 setup_20151215_221953317.html to %TEMP%\qt5bz7vafnf+8ud4pgnjwvi-whexhld8obrvlpiwfukg3lfxwywd3duxo7pbga7sp+knq3eaz7hk2dprn5gt3zshuk9omkbdd-eflbdstuvlfxfzcysisrxoy1z5lmamflyjn2tw1nvexs3isfea6aqzrtivfno+f2ullvas81a=.94ecc6bc932e8...
from %TEMP%\microsoft .net framework 4.5 setup_20150831_105942303.html to %TEMP%\jyup1wfo0kwavmab2zaxh6aso-zczo+utkibhaurmvm2m1uwahcjzlzrgrdjytibttebapsitdtsyzhct1dp87meufcbrtvkd0ybm2jd4iddups38uzbpri20bolpkuwiqbs4wznwprocm9wruxwg4a8xni1dlxq-0k5wsc6rzk=.94ecc6bc932e8...
from %TEMP%\microsoft .net framework 4.5 setup_20150820_123115526.html to %TEMP%\viq34uizwjgrr8ohvnt0rj5up4xqqkgidq4ieggturlwep46mlpuragecjy1+ytq+dcvia8seuovuf-1nu9sys2knxznx12zvnlqfjpw4wnt2xzbkfdmajcmseyek0ixbisx8mpjk1jkmz6uuumgm3ynetn+drccrv1ofdsulye=.94ecc6bc932e8...
from %TEMP%\dd_vcredist_x86_20151215221751.log to %TEMP%\cta0du04b2sdqlcnionp5pp7qnpafzllrwjmejv9csoz-ub7mdzhucalsn0lg0wclf13qegm8xtw1b5gbu68ywbm1jhr4uvgr2lcvbgcpsy=.94ecc6bc932e85461504.crypted000007
from %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log to %TEMP%\wld5s6mebyevnri4kyswlqxls1s6u45v7chomwplwlf9tf6hkmwxyi6fzgjtaaf-scv7wqdvoq1db5brtv55ijsxlh4hfrkvhznplrzth2wommo0nmehptzo4fowtcz3z4dpsezal4kiq5jgbmovrodzx0vltkkbiib6q396zo4=.94ecc6bc932e8...
from %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log to %TEMP%\7ny6z83qktl9s9r0fy8vdgjjrvddvhenlcrcoklginciw5fnxbsxsakitkjm2064f6y3jmu9rfzp6g8e2uo-vzjuz6goeazpueigavwz9b7cgakjsejcxe0w7t4mbravamdak8p4awhnaspjdbivlkmlnrwrb3psjikw3i3xfug=.94ecc6bc932e8...
from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd4ac6vq8g+hicria-sddggmawrdqk7ozfdeak9tj-al8rdlcuaiyog22efdvura.94ecc6bc932e85461504.crypted000007
from %TEMP%\dd_xps.txt to %TEMP%\+icj3qi+ivfdtbv9y0ewswlb9zjleejxtoth4zqzlug=.94ecc6bc932e85461504.crypted000007
from %TEMP%\dotnetfx.log to %TEMP%\klgysv6f7ldrh1rjgy-y-y4mga0g3ji1+8fawcf83aa=.94ecc6bc932e85461504.crypted000007
from %TEMP%\dotnetfxsdk.log to %TEMP%\tefal5ktxfh-gu20nmnsqkyz7-bnk24dtalk8t3ntli=.94ecc6bc932e85461504.crypted000007
from %TEMP%\javadeployreg.log to %TEMP%\girsdqqakm8kflojysp0qht1ugm+ym-mlqr0ckmasoooauoofio9lj3nbl3awhjc.94ecc6bc932e85461504.crypted000007
from %TEMP%\jaureg.log to %TEMP%\pljdhwjd8rhi3ncknzvp2k3yhjffoj3los10nhufjjs=.94ecc6bc932e85461504.crypted000007
from %TEMP%\java_install.log to %TEMP%\p54nkdy-7qynzsuvxbhh+emap1caktqhcmkvup6gfqe=.94ecc6bc932e85461504.crypted000007
from %TEMP%\java_install_reg.log to %TEMP%\xflz+ngikpeiih62rcrequ18lfy5eujcvykcec0amiy-rmgx+-mqgq2xjfjox5me.94ecc6bc932e85461504.crypted000007
from %TEMP%\jawshtml.html to %TEMP%\v2-wybtwrpybkhycziwwcwrwjk7jsj-wuy0ieao48dc=.94ecc6bc932e85461504.crypted000007
from %TEMP%\jusched.log to %TEMP%\zebdam518hxkr+nglxfvjynlwhc9oalcyaqrb2xnoqi=.94ecc6bc932e85461504.crypted000007
from %TEMP%\microsoft .net framework 3.0-kb976570_20150831_175648373.html to %TEMP%\8f-lclpspfnlsiyzbvywrdc6lpwqxpijh-wfvv8gc6yzcyseweiazjc0sc-qew0rfph3kljvipennw0blguatu3wdhzabj2gysnffzuvrww5s6vyqnz0m1fli+zsx6x9akdmtcorxrns+nwitbdyetyc9hx4hkpkeot20pwfnxw=.94ecc6bc932e8...
from %TEMP%\microsoft .net framework 4 setup_20150820_122814726.html to %TEMP%\hpkypcximzo9nxlkizobgj---wim1c748dqgfmua9t3wz1rrfjddnlh3ai+obqfh4lgf2j1tbxdapogsvcsw78y3zl7gu92fkpiwb0ryv+ahgqhvrpmuqb-bqiwaior8l8oer1fvqqc892kx5b4+iw==.94ecc6bc932e85461504.crypted00000...
from %TEMP%\microsoft .net framework 4 setup_20150831_105924687.html to %TEMP%\krknbk2jzq3ba4d482cwf5xuqwuwaja+pkanufajlvwp3+lhpal0ir-vgq4z39ua-ks2iz5maxxrl0ohhccc8obu3qob2ptlsf+yfea5pkbhtokwi4trgus-jo+y4jhsxiymeqepegoiwfs1y2gvdw==.94ecc6bc932e85461504.crypted00000...
from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\gezkp9lvzx1wzqqbos7kb0q075ws4opgq6e6chnnw7hqnrrvmwttq59uxkg7w8hcdlfzocxfnc-opjfo4p5zxq==.94ecc6bc932e85461504.crypted000007
from %TEMP%\2.9.0.1467 (partner)\stdout.log to %TEMP%\2.9.0.1467 (partner)\m6c+gopzwxrjisw3kitkofelkgdx-qz56cc4nmhjap0=.94ecc6bc932e85461504.crypted000007
from %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\downloader.log to %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\yi0mvjxpnr+pdn7lqe2abs7pojtggwrttiixue31ufu=.94ecc6bc932e85461504.crypted000007
from %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\seed.txt to %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\gni9gfomvcdqu7j2-eczig==.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\lubuntu-vertical.bmp to %TEMP%\pyl1.tmp\data\images\htonrwsyoghvcpcmtqt4+izv5wibmantohijjafjjfmxtc-y2zgsqygroum-avbt.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\mythbuntu-header.bmp to %TEMP%\pyl1.tmp\data\images\xcomldzjnhjxppihgacjbvgsf4-mdfthagerqrrvcrnlvvbdo8xq7ktdbwaq5pj4.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\mythbuntu-vertical.bmp to %TEMP%\pyl1.tmp\data\images\+1m5kltihwu47hv6psjtn2mnu5annk+qbbisuvbttp6xut03draolflf6qlypk84.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\preferences-desktop-locale.png to %TEMP%\pyl1.tmp\data\images\5bdniln1nezc-3azgxiqbqpgiytl-v+40x5qsub7e+rqxy289cifecfdrpzaqumj2i7j6gud2xbyscbs7athjw==.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\ubuntu studio-header.bmp to %TEMP%\pyl1.tmp\data\images\zio0zsbiphwi8zkquaokn3jbgp-uj93axqoeyi1bjjxlhp7+iil8hzethueetm2i.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\ubuntu studio-vertical.bmp to %TEMP%\pyl1.tmp\data\images\f3cdmi2gamjp9kmggfe3jcjwtcvdvsuvymw97h0nvas26wnhb1yyayrs9vq42olq49eaju6vm4ehe3nsye8tzw==.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\ubuntu-header.bmp to %TEMP%\pyl1.tmp\data\images\-suiuqxmolhmh8zd3rkdcs-hmt1t+kiwkbnahi0es4fvy6ke+yvltzs5jnhompc9.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\ubuntu-vertical.bmp to %TEMP%\pyl1.tmp\data\images\pcxusncphl+sw82p8ynxnskmqrtjj8xc3uma0vzbrcg1ahmcrkgd4rcxfkes4bpt.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\user.bmp to %TEMP%\pyl1.tmp\data\images\id4lgbcmwnfazy+p1pcyww==.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\winboot\wubildr.tar to %TEMP%\pyl1.tmp\winboot\6tvaxp4j63q4-huxo1rty-pw-8ae9zzdzxonse7e2ig=.94ecc6bc932e85461504.crypted000007
from %TEMP%\<INETFILES>\content.ie5\index.dat to %TEMP%\<INETFILES>\content.ie5\w8bvrghzgxi0ycawq7uc+4ltnaseyfnmvevvaklu65q=.94ecc6bc932e85461504.crypted000007
from %TEMP%\outlook logging\firstrun.log to %TEMP%\outlook logging\yo0bcw8ivko9eui+mrsfrx7qb6rlgxeel2gfzs9x7mk=.94ecc6bc932e85461504.crypted000007
from %TEMP%\6893a5~1\cached-microdesc-consensus.tmp to %TEMP%\6893a5~1\cached-microdesc-consensus
from %TEMP%\6893a5~1\cached-certs.tmp to %TEMP%\6893a5~1\cached-certs
from %TEMP%\6893a5~1\unverified-microdesc-consensus.tmp to %TEMP%\6893a5~1\unverified-microdesc-consensus
from %TEMP%\pyl1.tmp\data\images\lubuntu-header.bmp to %TEMP%\pyl1.tmp\data\images\6pg9ncpvevhvs+uz8ve7yg7knxxbk6yf5hpv67dnotxwbkonhmak6bnbsdygngxk.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\lock.bmp to %TEMP%\pyl1.tmp\data\images\b2egwxebfhpowrddqjk5og==.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\language.bmp to %TEMP%\pyl1.tmp\data\images\yqd6q+tlryss7lxwe6cu-7x3e36xrkimjn6busqwcku=.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\kubuntu-vertical.bmp to %TEMP%\pyl1.tmp\data\images\cxt1kigmk95qphbxtxiccbbayjbbb7t9k16jilprrvkziotfdbuhbo1ljksgvwlo.94ecc6bc932e85461504.crypted000007
from %TEMP%\adobe_admlogs\adobe_gde.log to %TEMP%\adobe_admlogs\vophtgscxzpndz1r9mgoplx6oos10csaaql11x4bxc8=.94ecc6bc932e85461504.crypted000007
from %TEMP%\cookies\index.dat to %TEMP%\cookies\oiwsrbrun5dd2etcitkqe0fjif9u-zxlvsgiuwc9fxk=.94ecc6bc932e85461504.crypted000007
from %TEMP%\history\history.ie5\index.dat to %TEMP%\history\history.ie5\xbf7f+tvueysbmvtwa3os0-bhdz8ipbetibzatqiyzu=.94ecc6bc932e85461504.crypted000007
from %TEMP%\opera installer\opera_installer_20150820123552.log to %TEMP%\opera installer\au2vsgb4e1r4i3d6347bb39oxq8yhpszbpugy8mgzewuu8qhujneqolizw2eeg7xc01qi+gbut8olbxtyqaqmxulkxs21gjivpp3dqqeumm=.94ecc6bc932e85461504.crypted000007
from %TEMP%\opera installer\opera_installer_20150820123553.log to %TEMP%\opera installer\dhftsyfaih30ibu7bpjeplaotkwejvk9igx3csf90+xro5oxekgxg13zg6sk9hsu3pgp7iqgyudhi6sbpfml1gy6n6rqqtb+6rop93wvopu=.94ecc6bc932e85461504.crypted000007
from %TEMP%\opera installer\opera_installer_20150820123555.log to %TEMP%\opera installer\pcqdkemtd5sxj2c4aavc1rihttyckjjkuev-hzgp7nvdzxkcjutd-hnykcfk-o4hd3swioxh2y5htax5+b9vqwybu2ylkl0ecehmupb4ezu=.94ecc6bc932e85461504.crypted000007
from %TEMP%\opera installer\opera_installer_20150820123618.log to %TEMP%\opera installer\n5igedr0zgzai696m8sp7+md+akuut-oaufktkcn+qxyhbihphv0cumet+uzkktrauwqvvnrscflzwo3pysrqawfchlkzswawz86u7rbvoy=.94ecc6bc932e85461504.crypted000007
from %TEMP%\opera installer\opera_installer_20160310145357.log to %TEMP%\opera installer\r1lpyabe4h-wlobglspyeaqv9j9bf2gpzeubp7mokuy1efwhfvptnhtaac+cq35nc3imktkbldghcxhkx9p+stnnzvwxweul31tnydgj4qo=.94ecc6bc932e85461504.crypted000007
from %TEMP%\opera installer\opera_installer_20160310145355.log to %TEMP%\opera installer\6-xynigmiriuxhcrltp8sxbm-y75bf9dfuamwkyd836jgcxz5tf6tpu2ynfhaag6kxhtjjbujrc2paodrf6jsusy6pestyjhjyac8ukigoa=.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\isolist.ini to %TEMP%\pyl1.tmp\data\u4ada0ekonfcjsgzppigo72bkworbtapjwm66tl4rrs=.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\desktop.bmp to %TEMP%\pyl1.tmp\data\images\bcrjdwdnif87wivm072hqlhuuczftsq05-khseb80hu=.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\disksize.bmp to %TEMP%\pyl1.tmp\data\images\qg4dbwqxu-+h+wupv9npdcmj7yq-dz9uqjbzfvv-ppg=.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\edubuntu-header.bmp to %TEMP%\pyl1.tmp\data\images\y0rolnxupfeayg0aigv91hprbkqmbnhk4u3rxlg0synu6kqhgdagilu44py-0dj7.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\edubuntu-vertical.bmp to %TEMP%\pyl1.tmp\data\images\m5plgxdnp5x0zmsqo1cropdrvt2nt4iaumyadmivck05dc+i7vmunyiucvsd9w-f.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\install.bmp to %TEMP%\pyl1.tmp\data\images\adbry03qbctoq8c3q2uhuia-sb2r37k24vx91hxx5hy=.94ecc6bc932e85461504.crypted000007
from %TEMP%\pyl1.tmp\data\images\kubuntu-header.bmp to %TEMP%\pyl1.tmp\data\images\sd8d2-ymzfq+wbyuewgxxiqhjhmgvik+xgszgi-ohiggaaajizuvwulldutdlbr9.94ecc6bc932e85461504.crypted000007
from %TEMP%\adobe_admlogs\adobe_adm.log to %TEMP%\adobe_admlogs\ygcdgdkomcz65zzopudetn5mykdnay-8eigmfhvph+i=.94ecc6bc932e85461504.crypted000007
from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\10lzlzk0++vs1mbq9udueex8rg0-tpbfzp3oetq7tges+vf4qf+p6vsbyahh3dysgnsa+4w9nnm+nh2b9z24wg==.94ecc6bc932e85461504.crypted000007

Substitutes the following files

%TEMP%\6893a5~1\state.tmp
%TEMP%\6893a5~1\state

Deletes itself.

Network activity

TCP

HTTP GET requests

http://ra####finance.org/wp-content/themes/Appatam/1c.jpg

UDP

DNS ASK ra####finance.org

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c %TEMP%\rad69787.tmp' (with hidden window)
'<SYSTEM32>\cmd.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c %TEMP%\rad69787.tmp
'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\chcp.com'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial